01 ·
Technical view
For those who work on the systems: open cases, covered components, what the analysts are doing right now and why.
Fortgale Defence Platform: the portal for Cyber Defence and Cyber Threat Intelligence.
One access where the Fortgale team and the customer work on the same case: defence, intelligence and modules. The analysts work in the platform, you see what they see.
Operations
Milan SOC since 2017
24·7·365
European team
Access
Microsoft Entra ID
Roles
Data separated per customer
The model
A team with a platform.
A platform without analysts is a product to manage. Here it is the opposite: the analysts of the Milan SOC, operating since 2017, work inside the Fortgale Defence Platform and the customer sees everything they see. It is the direction described in from MDR to MDIR: intelligence inside the defence cycle, not beside it.
<15 min
median TTD
from telemetry to alert
from telemetry to alert
<30 min
median TTC
from detection to action
from detection to action
>90 %
noise reduced
from day 30
from day 30
287
adversary groups and attack tools
tracked by CTI
tracked by CTI
First access
What you see when you log in.
Three views on the same data, each for the person who uses it. Each user gets theirs according to role.
02 ·
CISO view
For those who decide: the priorities of the day, the state of the active services and what needs a choice from the customer.
03 ·
Intel view
For those who read the intelligence: adversaries, campaigns and exposed surface that concern your context.
Cyber Defence
MDR, SOC, SIEM and Defence Map.
Defence run by the analysts, visible in the portal. The service is described on the MDR and Managed SOC pages; here, the portal.
01 ·
Defence Map
A map drawn in the portal or imported from draw.io: the customer's zones and components, highlighting components without EDR, zones without a sensor and systems that do not send logs to the SIEM. It exports to PNG, JSON and CSV. It is a map built together with the customer: no automatic discovery. Included in MDR Tier 1 and Tier 2.
02 ·
SIEM Monitoring
The dashboard of credit consumption and the inventory of collectors: how much is used, where the logs come from, what is missing.
03 ·
MDR and SOC in one place
Cases, analyst actions and service status in the portal, with the coverage hours chosen by the customer.
Cyber Threat Intelligence
Contextual and Advanced.
Two levels of intelligence applied to the customer's context, on the same cycle as the defence. The full picture is on the Cyber Threat Intelligence page. Contextual Intelligence and Advanced Intelligence include the AI Assistant.
AI Assistant
Three assistants, only your data.
AI integrated into the platform and applied to the customer's data, on European infrastructure. Three assistants, Technical, CISO and Intel, answer on the customer's data only and conversations are saved. It is included with Contextual or Advanced Intelligence, with 5 AI credits per contract year (1 credit = 1 message): they are reassigned at each anniversary of the contract, unused ones remain available and more can be requested when needed. It is not the security service for a company's own AI, which is a different thing.
Catalogue
Modules and features of the platform.
Each customer sees the modules they have activated. The cards lead to the page that describes the service.
Cyber Defence
Cyber Defence · Available
Managed Detection & Response
Detection and response by the Milan SOC, with the Defence Map included in the Tier 1 and Tier 2 levels.
Discover →
Cyber Defence · Available
Managed SOC and hours
24·7·365 coverage with the hours chosen by the customer, on the same case the customer sees in the portal.
Discover →Cyber Defence · Available
SIEM Monitoring
Dashboard of credit consumption and inventory of the SIEM collectors.
Discover →Cyber Defence · Available
Threat Hunting
Proactive search for adversary traces in the customer's environments, run by the analysts.
Discover →Cyber Defence · On request
Network Security
A Fortgale sensor on the network, as an extension of the SOC service.
Discover →Cyber Defence · Available
Deception
Decoys in the network or DMZ: whoever touches them is hostile. Sources and credentials tried in the portal; with an MDR domain the events join the defence cycle.
Discover →Cyber Defence · Available
M365 Phishing Interceptor
Protection of Microsoft 365 from phishing that steals sessions (AiTM).
Discover →Cyber Threat Intelligence
Threat Intelligence · Available
Contextual Intelligence
Intelligence applied to the customer's context: sector, technologies and the adversaries that concern them.
Discover →Threat Intelligence · Available
Advanced Intelligence
The higher level of intelligence, with more depth on adversaries and campaigns.
Discover →Threat Intelligence · Available
AI Assistant
Three assistants on the customer's data only. Included with Contextual or Advanced Intelligence.
Read the section ↓Threat Intelligence · Available
Digital Risk Protection
Digital risks outside the perimeter: brand, domains, profiles and exposed data.
Discover →Threat Intelligence · Available
External CTI
External monitoring of closed and criminal sources, carried out with a specialised partner.
Discover →Threat Intelligence · Available
Threat Intelligence Feed
Indicators curated by the analysts, to integrate into the customer's tools.
Discover →Threat Intelligence · Available
C2 tracking
Tracking of the command and control infrastructure used by adversaries.
Discover →Threat Intelligence · Available
Threat Actor Profiling
The profiles of the 287 adversary groups and attack tools tracked.
Discover →Exposure and posture
Exposure and posture · Available
Exposure (EASM)
The external attack surface as an attacker would see it.
Discover →Exposure and posture · On request
Identity Exposure
An assessment of exposed identities, not continuous monitoring.
Discover →Exposure and posture · On request
Cloud Posture
The security posture of Microsoft 365 and the cloud, explained in the dedicated guide.
Read the guide →
Exposure and posture · On request
Attack Simulation
Attack simulations to test the defences, within the Advisory service.
Discover →Exposure and posture · Available
Compliance
The customer's compliance picture, available in the portal.
Discover →Advisory
Advisory · Available
Vulnerability Assessment
Vulnerability assessment run by the Advisory team.
Discover →Advisory · Available
Incident Response and DFIR
Intervention and forensic analysis when the incident is under way or has already happened.
Discover →Deliverable: dashboards in the Fortgale Defence Platform, no periodic report included.
Activation
Going live.
It starts with the users and the responsible person named by the customer. Then come the first login and the customer's platform key; after that, module by module, each with its own configuration.
Portal security
Access with Entra ID, separated data.
Authentication goes through Microsoft Entra ID. Access is by role and each customer's data stays separated per tenant.
Boundaries
What it is not.
It is not a SIEM to buy and run. It is not an automatic report: the deliverable is the dashboard. And it does not replace the analysts: it puts them on the same screen as the customer.
FAQ
Frequently asked questions about the platform.
Do I need an MDR to get the portal?
No. The modules of the Fortgale Defence Platform can be bought on their own: each customer sees the modules they have activated in the portal, with or without the MDR service.
Who sees what?
Access is role based. The person the customer names as responsible decides who gets in and with which view: Technical for those who work on the systems, CISO for those who set priorities, Intel for those who read the intelligence. Each user only sees the modules of their own customer.
What happens at expiry?
When the contract expires without renewal, access to the modules ends. The data stays with the customer for the period set by the contract.
Where is the data hosted?
On infrastructure in Europe, with data kept separate for each customer.
Talk to the team
A team with a platform, at your disposal.
A conversation to understand which modules fit your context. Milan SOC, operating since 2017, 24·7·365: the team replies within one working day.