The Fortgale European SOC 24·7·365 on the Splunk ES console. SPL detection rules tuned on European TTPs, <30 min median containment, response orchestrated via Splunk SOAR.
Splunk Enterprise Security is the Gartner Leader SIEM/SOAR for the 11th consecutive year. Fortgale operates it with European analysts who develop custom SPL detection rules on European actor TTPs.
Notable events, risk-based alerting, MITRE ATT&CK mapping. Native data ingestion from any source via Universal Forwarder. Risk-based alerting for noise reduction up to 90%. Fortgale delivers detection and response on the platform modules Splunk Enterprise Security · Splunk SOAR · User Behavior Analytics (UEBA) · Splunk Attack Analyzer.
L2/L3 analysts develop custom SPL rules and ES content packs tuned on European TTPs. Triage <15 min on notable events. Threat hunting on Splunk Search using proprietary CTI.
Custom playbook orchestration via Splunk SOAR: cross-tool response, automatic enrichment, ticketing. Direct escalation to Fortgale IR. Full NIS2 national CSIRT notification support.
From data ingestion to SOAR response, all governed by Fortgale with European analysts and proprietary CTI on European markets.
Splunk Cloud or on-prem with all data sources connected: endpoint, firewall, AD, M365, AWS/Azure, custom apps. Universal Forwarder + HEC + APIs.
ES content packs + custom SPL rules tuned by Fortgale on European actor TTPs. Risk-based alerting reduces noise by 90%, only real notables reach analysts.
European SOC specialised on Splunk. Triage on notable events, hunting via Splunk Search, attribution to actor. Direct interaction in your business language.
Containment via Splunk SOAR custom playbooks: EDR isolation, AD lockout, firewall block, ticketing. Direct escalation to Fortgale IR for critical incidents.
Metrics measured on real customer telemetry, Q1 2026, updated quarterly.
The platform produces telemetry. What is missing is the people who read it around the clock, prioritise it and turn it into decisions.
Tier-zero AI filters, analysts decide: noise reduced >90% by day 30. Every alert that reaches you is already a qualified case.
L2/L3 analysts who operate the Splunk console every day: detection tuning, MITRE-mapped runbooks, native response on your platform.
European SOC, headquartered in Milan since 2017, 24·7·365: median TTD <15 minutes, median TTC <30 minutes.
Multi-stage intrusions detected, contained and publicly documented by the research team: Operation Storming Tide, Operation MN-1224.
Proprietary CTI on 287 tracked adversary groups and attack tools: advisories, IOCs and actor profiles feed directly into detection on your platform.
Selection of credential-theft threats detected on Fortgale customers with Splunk Enterprise Security. Splunk RBA (Risk-Based Alerting) aggregates multiple indicators into single notable events to reduce fatigue.
Vector Distributed via malvertising, fake cracked software, drive-by · credential harvest from 100+ applications · plaintext HTTP / Telegram bot exfiltration
Detection · Splunk Splunk ES correlation rules on rare DNS queries + Fortgale IOC feed via Threat Intel Management · RBA risk score >80 trigger.
Vector Distributed via fake CAPTCHA verification · process hollowing into legitimate browser · C2 exfiltration to dynamic DNS Cloudflare-proxied
Detection · Splunk Splunk ML Toolkit anomaly detection on outbound traffic patterns + custom SPL searches updated monthly by Fortgale.
Vector Reverse-proxy phishing intercepts MFA session · session cookie hijack post-authentication · persistent access via OAuth refresh token
Detection · Splunk Splunk correlation between <em>impossible travel</em> + new device fingerprint + sign-in log audit · Fortgale runbook for token revocation.
Vector Phishing campaign brand-impersonating European financial institutions · landing pages hosted on bulletproof providers · credential harvest + token exchange
Detection · Splunk Splunk SOAR auto-blocking via firewall + Microsoft 365 + Okta logs correlation · weekly Fortgale IOC feed.
Every component designed to leverage Splunk ES with European SOC governance and proprietary CTI.
Splunk Cloud or on-prem licensing (or existing instance). Indexers, search heads, data sources, ES content packs managed by Fortgale. Continuous tuning.
Custom SPL rules MITRE ATT&CK-mapped, tuned on European actor TTPs. Risk-based alerting. New rules deployed monthly based on the threat landscape.
34,000+ IoCs per week from Fortgale OpenCTI auto-imported into Splunk Threat Intelligence Framework. Lookup tables for SPL detection.
Custom SOAR playbooks: cross-tool containment, automatic enrichment, ticketing. Direct escalation to Fortgale IR team for critical incidents.
Executive reports with MTTD, MTTR, alert volume, risk score trend. Custom Splunk Glass Tables. NIS2/ISO 27001/GDPR audit documentation.
Monthly hunting on Splunk Search using proprietary CTI + Sigma rules. Focus on silent lateral movement, persistence, data staging not covered by automatic detections.
The CISO decides on risk. The IT lead decides on the runbook. Fortgale MDR produces evidence for both.
Each month the CISO receives the profile of the 3 most likely actors against their sector, with the Fortgale MDR runbook already mapped to the Splunk Enterprise Security telemetry.
When the Splunk alert is real, decision time is containment time. Our L2/L3 analysts know the Splunk Enterprise Security console and have a mandate to decide.
Combines Splunk Enterprise Security (Gartner Leader SIEM) with the Fortgale European SOC 24·7·365. L2/L3 analysts develop custom MITRE-mapped SPL detection rules, monitor ES notable events, orchestrate response via Splunk SOAR and apply proprietary runbooks.
No. Fortgale handles the full cycle: Splunk Cloud or on-prem licensing, indexer/search head deployment, data sources integration, ES content packs, tuning. Available both on existing instance or as part of the service.
On request, yes. Splunk SOAR (formerly Phantom) is available as add-on module for playbook orchestration, cross-tool integration and response automation. The Fortgale SOC develops custom playbooks mapped to runbooks.
Yes. We support NIS2 transposition requirements: continuous monitoring, IoC collection for national CSIRT notification within 24 hours, technical documentation for 72-hour notifications. Splunk's configurable retention supports NIS2 log retention requirements.
Splunk Enterprise Security is SIEM. For XDR/EDR it combines with Splunk Attack Analyzer and add-ons/integrations with third-party EDR (CrowdStrike, SentinelOne, Defender). Fortgale orchestrates the entire stack.
We bring you the Report on your sector with the most likely actors and a concrete MDR runbook on your Splunk Enterprise Security console.
No nurturing sequences, no auto-replies. One of our analysts calls you back within one business day.
The full Report (executive summary · operational IoCs · technical runbook) is restricted. Share two details and one of our analysts contacts you with access and a short technical briefing.
Response in 30 minutes, containment in 1–4 hours. Even if you are not a Fortgale customer.
