Home
/
techsearch-case-study-mdr
/
stickmancyber-cyber-security-monitoring-incident-response-aged-care
StickmanCyber
Cyber Security Monitoring & Incident Response for an Australian Aged Care Provider
About the Vendor Response
This page presents the response provided by StickmanCyber to an Australian aged care organisation seeking a Managed Detection and Response (MDR) provider. The response was submitted through StrategyMix TechSearch and addresses the buyer's original requirements and qualifying questions.
Related Information
View Full buyer requirements
https://www.strategymix.com.au/techsearch-case-study-mdr/buyer-requirements-cyber-monitoring-incident-response
View Case Study and compare 8 vendor responses
https://www.strategymix.com.au/techsearch-case-study-mdr
Understand how TechSearch helps IT buyers
https://www.strategymix.com.au/techsearch
SEARCH DETAILS
Search Name:
Cyber Security Monitoring / Incident Response
Category:
Cyber Security
Budget Status:
Pending
Purchase Timeframe:
6 to 12 Months
Product Description:
I am looking for a 24x7 cyber security monitoring provider as well as cyber incident response support.
It would be helpful if the provider can utilise our existing investment in our current security monitoring tools, but there is an opportunity to onboard a more complete SIEM solution to upgrade our existing one.
I envisage that the incident response support component might be arranged on a retainer basis, with payment per incident. However, that is subject to whichever arrangement offers the most affordable solution.
VENDOR CONTACT
Name:
Ajay
Unni
Job Title:
CEO
Company:
StickmanCyber
REQUEST EMAIL INTRO WITH
SOLUTION OVERVIEW
StickmanCyber delivers a robust Managed Detection and Response service built entirely on the Google SecOps platform, integrating SIEM, SOAR, and Gemini AI with 12 months of hot searchable storage coupled with fixed predictable pricing.
We currently support over 70+ clients (including ASX listed and larger nor-for-profits) and is engineered for enterprise-wide visibility, threat detection, and automated response. StickmanCyber has configured and fine-tuned SIEM rules, develops 600+ custom use cases, and maintains 40+ SOAR playbooks for automated remediation storing up to 12 months of logs for retroactive threat hunting.
Alerts are enriched using Google threat intelligence, with contextual data from VirusTotal, WHOIS, and identity platforms. Gemini AI enhances triage with natural language insights and playbook generation. The solution supports seamless integration with all major applications, SaaS platforms and CSPs. Dashboards customised by StickmanCyber offering real-time analytics, UEBA, and risk scoring, enabling proactive security posture management.
QUALIFYING QUESTIONS
Q1.
Can you ingest and correlate data from CrowdStrike, Mimecast, Netskope, and Graylog?
StickmanCyber utilises the Google SecOps SIEM + SOAR+ Gemini AI platform to provide 24x7/365 Managed Detection and Response which includes Incidence Response (IR) Support. It is presently in the top right quadrant as per Gartner's magic Quadrant for SIEMs. The Google SecOps SIEM + SOAR+ Gemini AI platform already has 3000+ rules across all major applications and log sources. It provides out of the box integration with CrowdStrike, Mimecast and Netskope supporting endpoint detection alerts, CASB alerts, phishing emails notifications etc. Graylog is not supported by default and would need custom parser creation to translate the raw logs into UDM fields (SecOps supported).
StickmanCyber can also monitor your Google Workspace/ MS 365 environments and critical servers/ VMs (all CSPs) if needed, creating custom rule as per your unique requirements. Thus, this solution foregoes the need for Graylog SIEM with a platform wide comprehensive security solution.yber utilises the Google SecOps SIEM + SOAR+ Gemini AI platform to provide 24x7/365 Managed Detection and Response which includes Incidence Response (IR) Support across 40+ clients. It is presently in the top right quadrant as per Gartner's magic Quadrant for SIEMs.
Q2.
Can you enrich alerts with threat intelligence or contextual data from these platforms?
Yes, Google SecOps provides extensive enrichment for alerts from CrowdStrike, Mimecast and NetSkope and other log sources. This is done in the following manner:
(1) Threat Intelligence continuously analyses data against Google's threat intelligence and Mandiant's incident response findings worldwide. This automatically prioritises threats in client's environment with contextual information about threat actors and their campaigns.
(2) Entities (workstations, laptops, VMs) are enriched with data from Safe Browsing threat lists, VirusTotal metadata, WHOIS data, geolocation, prevalence statistics, and identity sources (Windows AD, Azure AD, Okta, Google Cloud IAM).
(3) Detection rules leverage enriched data including prevalence scores, first/last seen timestamps, entity relationships, and MITRE ATT&CK mappings for more accurate alerting.
Q3.
How do you prioritise alerts and reduce false positives?
We employ multiple strategies to prioritize alerts and minimize false positives: The SecOps platform automatically correlates logs across environments, contextualising and prioritising alerts. This reduces noise and help analysts focus on genuine threats.
Alerts are assigned priority levels (Critical, High, Medium, Low) based on rule analysis of the log sources and threat intelligence enrichment. Noisy rules are tuned down by setting them to "detect only" mode and creating composite detections that add conditions (e.g., "alert only if this occurs 5 times for the same user in one hour"). Gemini AI in the SecOps platform enhances detection quality through natural language investigations, insights, and recommended actions.
Q4.
Do you offer services to enhance or replace Graylog with a more scalable SIEM?
Yes, Google SecOps can serve as a more scalable replacement for Graylog as answered in Question 1 above. Built on Google's infrastructure SecOps scales to ingest, analyse, and search petabytes of data with 12 months of hot data storage by default. Google SecOps provides integrated SOAR functionality, native threat intelligence feeds and AI-powered detection authoring.
Migration Support: StickmanCyber can offer structured migration services including parallel ingestion, parser development for custom sources and detection rule translation from Graylog to Google SecOps.
Q5.
Do you offer retainer-based IR services or on-demand support?
Digital Forensics and Incident Response can be purchased additional starting at $25kUSD.