Threat detection and response for the attack that gets through
Threat detection and response is the part of security that plans for a bad day: something gets past your filters and antivirus, and someone has to notice it quickly and act on it with a plan. Granite Tech watches your devices, sign-ins, and network for activity that does not fit, investigates every alert, and walks a written incident process from first warning to final review. It is one layer of our cybersecurity services for Montana businesses, run by a local team you can call.
Prevention lowers the odds. Detection limits the damage.
Firewalls, spam filters, and antivirus are built to keep attackers out, and they stop most of them. They cannot stop all of them. A password typed into a convincing fake sign-in page, a vendor account that gets hijacked, or brand-new malware nobody has catalogued yet can all walk past controls that are working exactly as designed.
What happens next decides how bad the day gets. An attacker who sits in a mailbox for weeks can read invoices, redirect payments, and plan a ransomware attack at leisure. One who is spotted in the first hour usually leaves with very little. Threat detection and response is the work of shrinking that window: collecting the right signals, having a person look at what they show, and following a set plan when something is real.
Noticing what does not fit
Security software on each computer, sign-in records from Microsoft 365, and traffic logs from the firewall all report what they see. Detection means pulling those signals together, knowing what normal looks like for your office, and flagging the sign-in, process, or connection that breaks the pattern.
Acting on it with a plan
Response is everything after the alert: confirming whether it is real, cutting off the attacker, removing what they left behind, restoring normal work, and writing down what happened. Done well, it follows steps agreed with you in advance instead of decisions made in a panic.
The quiet signs that someone is already inside
Real intrusions rarely announce themselves with a ransom note on day one. They show up first as small changes that are easy to miss unless someone is looking. These are the patterns our monitoring is set to catch and investigate.
A login from another country an hour after the same person signed in from the office, or repeated failed attempts against one account overnight.
Rules that send copies of mail outside the company or hide replies in an obscure folder, a classic step before invoice fraud.
A new user with full rights, or an existing account suddenly added to an administrator group without a ticket behind it.
Antivirus disabled, logging stopped, or backups paused on a machine. Attackers try to blind your defenses before they act.
Hundreds of files renamed or rewritten in minutes on a file share, which is what ransomware encryption looks like from the outside.
A workstation talking to an unfamiliar server at 2 a.m., or a large upload to a destination your business has never used.
Many incidents start in the inbox. Our email security service stops most phishing before delivery, and the alerts above catch what happens when one message slips through.
Six stages from first alert to lessons learned
Every incident we handle moves through the same six stages, closely following the incident handling steps published by NIST and SANS. Step through them below with one example to see what happens at each point, who does the work, and what you get out of it.
Detect: a signal reaches a person
Monitoring collects activity from computers, Microsoft 365, and the firewall, and compares it with what is normal for your business. When something falls outside that pattern, an alert is raised with the context needed to judge it: which account, which device, what changed, and when.
The point of this stage is that the alert lands with someone whose job is to look at it, not in a shared inbox that nobody reads.
Her account signs in from an unfamiliar location minutes after the fake page captured the password, and a new rule appears that forwards invoices to an outside address.
Triage: is it real, and how far does it reach?
Most alerts turn out to be harmless: an employee on vacation, a new app syncing files, a software update. Triage separates those from the real ones by checking sign-in history, the device involved, and whether other accounts or machines show the same pattern.
A confirmed incident gets a severity level, and that level decides who is called from your contact list and which response steps begin.
The office manager confirms she was at her desk the whole time. The outside sign-in is not her, so the incident is confirmed and her account is the starting point.
Contain: cut off access before it spreads
Containment stops the attacker from going further while the full picture comes together. Typical steps are resetting passwords, ending every active session, disabling a compromised account, removing malicious rules, blocking a sender or address, and isolating an infected computer from the network.
Actions like these are agreed with you ahead of time, so they can happen right away. Bigger moves, such as taking a server offline during business hours, are made with your approval.
Her password is reset, every session is signed out, the forwarding rule is removed, and the sender of the fake document is blocked for the whole company.
Eradicate: remove the cause and anything left behind
Locking the door is not the same as clearing the house. Attackers often leave ways back in: a second mailbox rule, an app granted access to the account, a new user, or malware set to restart. Eradication hunts for those footholds and removes them.
It also fixes whatever let the attack work, whether that is a missing patch, a reused password, or an account without multi-factor sign-in.
A review of the account turns up a third-party app the attacker had approved. It is removed, her laptop is scanned, and multi-factor sign-in is required on the account.
Recover: get people working again, safely
Recovery returns systems to normal use: restoring files or whole machines from clean backups where needed, bringing isolated devices back onto the network, and confirming that business applications work as they should.
Recovered accounts and devices stay under closer watch for a while afterward, because an attacker who lost access sometimes tries again.
A few deleted messages are restored, her mailbox is back in use the same day, and her sign-ins are watched closely in the weeks that follow.
Review: write it down and close the gaps
Every confirmed incident ends with a written summary in plain language: what happened, how it was found, what was touched, what was done, and what changes are recommended so it does not happen the same way twice.
That record is what your insurance carrier, auditors, or attorney will ask for if the incident has to be reported, and the recommendations feed into your next security review.
The review checks whether any invoices left during the attack, recommends multi-factor sign-in on every mailbox, and adds a phone check for payment changes.
Stage 1 of 6: Detect
The hard decisions belong before the incident, not during it
The slowest part of most responses is not technical. It is finding out who is allowed to approve shutting down a system, who has the insurance policy number, and whether anyone remembers when the backups were last tested.
Part of setting up the service is settling those questions with you and writing the answers into an incident contact sheet that lives with your response plan. When an alert turns into a real incident, the plan is already agreed and the first calls are already decided.
- Who we call first, second, and after hours
- Which containment steps we can take without asking
- Who can approve taking a server or a site offline
- Your cyber insurance carrier and its claim instructions
- Where backups live and when a restore was last tested
- Which outside vendors have remote access to your systems
- Who speaks to staff and customers if an incident goes public
Reviewed whenever people, vendors, or systems change, so the sheet is current when it is needed.
Four steps to monitoring that produces real alerts
Detection is only as good as the signals feeding it and the tuning behind it. Too few sources and attacks go unseen. Too much noise and real alerts get buried. Setup runs in this order.
Map what matters
We inventory computers, servers, user and admin accounts, and the systems your business cannot run without, so we know what to protect first.
Connect the signals
Device security software, Microsoft 365 sign-in and mailbox activity, firewall logs, and backup status are brought into one place to be watched.
Tune out the noise
The first weeks establish what normal looks like for your office, and alert rules are adjusted so a real warning stands out instead of drowning.
Agree the playbook
Contacts, pre-approved containment steps, and escalation paths go into your written response plan and contact sheet.
After setup, alert history and response readiness are covered in our Healthy Business security reviews, so coverage keeps pace as staff, devices, and software change.
Cost, fit, and what this service does not replace
A few practical answers business owners usually want before a first call.
What decides the cost
The number of users and devices, how many locations and network connections are involved, which signal sources are connected, and whether the service is added to an existing managed IT agreement. Managed IT scales per user, and ongoing services run on standard agreements.
A 30 to 45 minute discovery call gives us enough to put scope, pricing, and timelines in a written proposal.
Businesses that cannot afford a quiet breach
Any company where a stolen mailbox or locked file server would stop work. It matters most for offices holding regulated data, such as clinics covered by our HIPAA-aware healthcare IT work, and for firms whose cyber insurance asks how incidents are detected and handled.
Small teams benefit most, since nobody in-house has time to watch alerts.
What it does not replace
Detection shortens an attack. It does not undo one. Tested backup and disaster recovery is still what brings encrypted files back, and security awareness training is still what keeps the next password off a fake sign-in page.
Urgent issues go straight to 406-505-5061.
A Montana team that keeps you informed at every step
Hospitals, banks, school districts, and county offices across Montana work with Granite Tech.
Read the case studiesThreat detection and response questions, answered
Threat detection and response is ongoing monitoring of your computers, accounts, and network for signs of an attack, paired with a set plan for acting on what is found. Detection spots activity that does not fit the normal pattern, such as an unfamiliar sign-in or a security tool being switched off. Response covers everything after that: confirming the threat, cutting off access, removing the cause, restoring normal work, and documenting what happened.
Antivirus and firewalls are built to block known threats at the door, and they stop most of them. They do not tell you when someone signs in with a stolen password, creates a hidden mailbox rule, or quietly adds an admin account, because none of those look like malware. Threat detection and response watches for that kind of behavior and puts a person on every alert, so an attack that gets past prevention is caught early instead of discovered weeks later.
Around-the-clock monitoring is part of our managed IT service, and our office hours are Monday to Friday, 8 AM to 5 PM. Before anything happens, we agree with you which containment steps we can take right away, such as disabling an account or isolating a laptop, and who we call for bigger decisions. If you notice something urgent yourself, call 406-505-5061.
Yes, because backups and detection solve different problems. Backups bring files back after an attack, but they do not stop someone from reading your email, redirecting payments, or copying client records first. Detection shortens the time an attacker has inside, and tested backups make recovery possible when something does get encrypted.
Cyber insurance applications commonly ask how you detect and respond to incidents, and a written response plan with real monitoring behind it makes those questions straightforward to answer. For Montana clinics, banks, and professional offices that handle regulated data, the written summary from each incident also gives your insurer, auditors, or attorney the record they need. We do not provide legal advice on reporting obligations, but we provide the facts your advisers will ask for.
Find out who would notice an attack on your network today
Request a short call to talk through what you have watching your devices and accounts now, where alerts currently go, and what would happen if one came in tonight. No pitch deck and no pressure. If there is a fit, a written proposal with scope and pricing follows.
Or email CustomerCare@granite.tech