The Fortgale European SOC 24·7·365 on the Kibana console. Custom ESQL/EQL detection rules on European TTPs, <30 min median containment, response via Elastic Defend and integrations.
Elastic Security is the most flexible open SIEM/XDR on the market: data-first model, native multi-petabyte search, no EPS limits. Fortgale operates it with European analysts who develop custom ESQL detection rules on European TTPs.
SIEM + XDR + Endpoint + Cloud Security in single platform. ESQL, EQL, KQL for any detection. Resource-based pricing, no EPS limits. Open ML detection jobs. Fortgale delivers detection and response on the platform modules Elastic Security SIEM · Elastic Defend (EDR) · Elastic Security for Cloud (CSPM/CWP).
L2/L3 analysts develop custom ESQL/EQL rules tuned on European TTPs. Triage <15 min on Elastic alerts. Threat hunting on the open data lake using proprietary CTI.
Containment via Elastic Defend (host isolation, process kill) + integrations (firewall, AD, EDR third-party). Direct escalation to Fortgale IR. Full NIS2 national CSIRT notification support.
From Elastic Agent ingestion to Defend response, all governed by Fortgale with European analysts and proprietary CTI on European markets.
Elastic Cloud or on-prem cluster with Elastic Agent + Fleet on endpoints, cloud, third-party integrations. Open data lake, no ingestion limits.
Pre-built rules + custom ESQL/EQL rules tuned by Fortgale on European actor TTPs. ML jobs for behavioural anomalies. False positives reduced by over 90%.
European SOC specialised on Elastic. Triage on alerts, hunting via Elastic Search/ESQL, attribution to actor. Decisions in your business language.
Containment via Elastic Defend (host isolation, process kill) + cross-tool playbooks. Direct escalation to Fortgale IR for critical incidents.
Metrics measured on real customer telemetry, Q1 2026, updated quarterly.
The platform produces telemetry. What is missing is the people who read it around the clock, prioritise it and turn it into decisions.
Tier-zero AI filters, analysts decide: noise reduced >90% by day 30. Every alert that reaches you is already a qualified case.
L2/L3 analysts who operate the Elastic console every day: detection tuning, MITRE-mapped runbooks, native response on your platform.
European SOC, headquartered in Milan since 2017, 24·7·365: median TTD <15 minutes, median TTC <30 minutes.
Multi-stage intrusions detected, contained and publicly documented by the research team: Operation Storming Tide, Operation MN-1224.
Proprietary CTI on 287 tracked adversary groups and attack tools: advisories, IOCs and actor profiles feed directly into detection on your platform.
Selection of post-exploitation tools and C2 malware detected on Fortgale customers with Elastic Security. Elastic scalability + Lucene query language handles 90+ days of telemetry full-text searchable in seconds.
Vector Metasploit payload · in-memory injection · token impersonation · keylogging · privilege escalation
Detection · Elastic Elastic Defend EDR + custom KQL rules on <em>encoded payload patterns</em> + ML anomaly detection on process behaviour.
Vector PowerShell stager · AMSI bypass · DPAPI extraction · Mimikatz invoked via reflective DLL
Detection · Elastic Elastic Security pre-built rules for <em>PowerShell suspicious args</em> + ECS-mapped events correlation cross-host.
Vector Distributed via malvertising and phishing attachments · credential harvesting from browsers + FTP + crypto wallets · exfiltration via Telegram bot API
Detection · Elastic Behavior analytics ML jobs on anomalous exfiltration + Fortgale IOC feed pushed into Elastic Fleet · 34,000+ indicators.
Vector USB infection · LNK file abuse · privilege escalation via cmd.exe spawning · pivot to secondary payloads (SocGholish, Bumblebee)
Detection · Elastic Elastic SIEM USB-borne detection rules + cross-domain correlation with DNS anomaly and proxy logs.
Every component designed to leverage Elastic Security flexibility with European SOC governance and proprietary CTI.
Elastic Cloud or on-prem licensing (or existing instance). Cluster, Fleet, integrations, detection rules managed by Fortgale. Continuous tuning.
Custom ESQL/EQL rules MITRE ATT&CK-mapped, tuned on European actor TTPs. ML jobs for behavioural anomalies. New rules deployed monthly.
34,000+ IoCs per week from Fortgale OpenCTI auto-imported into Elastic Threat Intelligence. Indicator match rules for native detection.
Containment via Elastic Defend: host isolation, process kill, ransomware behavior protection. Cross-tool playbooks for AD lockout, firewall block, third-party EDR.
Executive reports with MTTD, MTTR, alert volume, risk trend. Custom Kibana dashboards. NIS2/ISO 27001/GDPR audit documentation.
Monthly hunting on the Elastic data lake using proprietary CTI + Sigma rules. Focus on silent lateral movement, persistence, data staging not covered by automatic detections.
The CISO decides on risk. The IT lead decides on the runbook. Fortgale MDR produces evidence for both.
Each month the CISO receives the profile of the 3 most likely actors against their sector, with the Fortgale MDR runbook already mapped to the Elastic Security telemetry.
When the Elastic alert is real, decision time is containment time. Our L2/L3 analysts know the Elastic Security console and have a mandate to decide.
Combines Elastic Security (SIEM + XDR + Endpoint) with the Fortgale European SOC 24·7·365. L2/L3 analysts monitor the Kibana console, develop custom ESQL/EQL detection rules, apply MITRE-mapped runbooks and trigger response via Elastic Defend and integrations.
Elastic has a data-first model: no ingestion limits (resource-based pricing, not EPS), native multi-petabyte search, ability to develop detection rules in ESQL/EQL/KQL on any schema. Ideal for those who want flexibility and ownership of the security data lake.
No. Fortgale handles the full cycle: Elastic Cloud or on-prem licensing, cluster deployment, Fleet integrations, detection rules development, tuning. Available both on existing instance or as part of the service.
Yes. We support NIS2 transposition requirements: continuous monitoring, IoC collection for national CSIRT notification within 24 hours, technical documentation for 72-hour notifications. Elastic's configurable retention supports NIS2 log retention requirements.
Yes. Elastic Security includes: SIEM (log correlation), XDR (cross-domain analytics), Endpoint Security (Elastic Defend agent), Cloud Security Posture, Container Workload Protection. The Fortgale MDR service covers all these domains.
We bring you the Report on your sector with the most likely actors and a concrete MDR runbook on your Elastic Security console.
No nurturing sequences, no auto-replies. One of our analysts calls you back within one business day.
The full Report (executive summary · operational IoCs · technical runbook) is restricted. Share two details and one of our analysts contacts you with access and a short technical briefing.
Response in 30 minutes, containment in 1–4 hours. Even if you are not a Fortgale customer.
