01 ·
Elastic SIEM/XDR · open data
SIEM + XDR + Endpoint + Cloud Security in single platform. ESQL, EQL, KQL for any detection. Resource-based pricing, no EPS limits. Open ML detection jobs.
MDR sur Elastic Security: open SIEM/XDR with custom ESQL detection.
The Fortgale SOC européen 24·7·365 on the Kibana console. Custom ESQL/EQL detection rules on European TTPs, ~11 min median containment, response via Elastic Defend and integrations.
Fortgale × Elastic
MDR · live
Sensore Elastic attivoTelemetria endpoint · cloud · identità
Elastic SOC italiano 24·7·365Analisti L2/L3 · interlocuzione diretta
Fortgale Tier-zero AI multidominioRumore ridotto del 94%
Fortgale Risposta nativa ElasticIsolamento host mediano ~8 s
Live Intelligence proprietaria34 000+ IOC settimanali · attori italiani
Fortgale MDR operativo — Elastic + Fortgale SOC attivi
Conformità
ISO/IEC 27001
NIS2 ready
DORA aligned
GDPR · ACN
Partnership tecnologica
Elastic Security
MITRE ATT&CK aligned
OpenCTI
Pourquoi Fortgale + Elastic
The open SIEM/XDR platform, governed with proprietary CTI.
Elastic Security is the most flexible open SIEM/XDR on the market: data-first model, native multi-petabyte search, no EPS limits. Fortgale l'opère avec analystes européens who develop custom ESQL detection rules on European TTPs.
02 ·
SOC européen 24·7·365
L2/L3 analysts develop custom ESQL/EQL rules tuned on European TTPs. Triage <15 min on Elastic alerts. Threat hunting on the open data lake using proprietary CTI.
03 ·
Native response + IR
Containment via Elastic Defend (host isolation, process kill) + integrations (firewall, AD, EDR third-party). Escalade directe to Fortgale IR. Accompagnement complet à la notification CSIRT national NIS2 notification.
Comment ça marche · architecture
Quatre blocs, un cycle MDR on Elastic.
From Elastic Agent ingestion to Defend response — le tout gouverné par Fortgale with analystes européens and proprietary CTI sur les marchés européens.
01 ·
01 · Ingestion
Elastic Agent + Fleet active
Elastic Cloud or on-prem cluster with Elastic Agent + Fleet on endpoints, cloud, third-party integrations. Open data lake, no ingestion limits.
02 ·
02 · Tier-zero
Custom ESQL detection + ML
Pre-built rules + custom ESQL/EQL rules tunés par Fortgale on European actor TTPs. ML jobs for behavioural anomalies. Faux positifs réduits by 94%.
03 ·
03 · Analysts
Our L2/L3 on Kibana
European SOC spécialisés sur Elastic. Triage on alerts, hunting via Elastic Search/ESQL, attribution to actor. Decisions dans votre langue business.
04 ·
04 · Response
Defend + cross-tool
Containment via Elastic Defend (host isolation, process kill) + cross-tool playbooks. Escalade directe to Fortgale IR for incidents critiques.
Proof · metriche del servizio
Quattro numeri che reggono l'MDR su Elastic.
Metriche misurate sulla telemetria reale dei nostri clienti — Q1 2026, aggiornate trimestralmente.
~11 min
Confinement médian
from confirmed Elastic alert
from confirmed Elastic alert
94 %
Bruit réduit
par ESQL + ML detection
par ESQL + ML detection
Open
Data lake ownership
no ingestion limits
no ingestion limits
12 days
Onboarding complet
Elastic Security + Fleet
Elastic Security + Fleet
Ce que comprend le service
MDR sur Elastic, en détail.
Every component designed to leverage Elastic Security flexibility with European SOC governance and proprietary CTI.
01
Managed Elastic Security
Elastic Cloud or on-prem licensing (or existing instance). Cluster, Fleet, integrations, detection rules managed by Fortgale. Continuous tuning.
02
Custom ESQL/EQL detection
Custom ESQL/EQL rules MITRE ATT&CK-mapped, tuned on European actor TTPs. ML jobs for behavioural anomalies. New rules deployed monthly.
03
Proprietary CTI in Elastic
34,000+ IoCs per week from Fortgale OpenCTI auto-imported into Elastic Threat Intelligence. Indicator match rules for native detection.
04
Elastic Defend response
Containment via Elastic Defend: host isolation, process kill, ransomware behavior protection. Cross-tool playbooks for AD lockout, firewall block, third-party EDR.
05
Reporting & governance
Executive reports with MTTD, MTTR, alert volume, risk trend. Custom Kibana dashboards. NIS2/ISO 27001/GDPR audit documentation.
06
Threat hunting on Elastic
Monthly hunting on the Elastic data lake using proprietary CTI + Sigma rules. Focus on silent lateral movement, persistence, data staging not covered by automatic detections.
Per chi · due angolazioni
Stesso MDR su Elastic, due angolazioni.
Il CISO decide sul rischio. Il responsabile IT decide sul runbook. MDR Fortgale produce evidenze per entrambi.
Per il CISO
Un runbook nominativo per attore, su stack Elastic.
Il CISO riceve ogni mese il profilo dei 3 attori più probabili contro il proprio settore, con il runbook MDR Fortgale già mappato sulla telemetria Elastic Security.
- Threat briefing mensileAttori, TTP osservate, campagne in corso sul vostro settore.
- Runbook su ElasticPlaybook vivi mappati MITRE, eseguibili sulla console Elastic Security.
- Reporting board-readyRischio · impatto · decisione. Niente tecnologia da slide.
Per il responsabile IT
Zero handover traduttore. Analisti italiani sulla vostra console Elastic.
Quando l'alert Elastic è reale, il tempo di decisione è il tempo di contenimento. I nostri analisti L2/L3 conoscono la console Elastic Security e hanno mandato di decidere.
- Contenimento mediano ~11 minDall'alert confermato alla remediation in produzione.
- Risposta nativa ElasticKill processi, isolamento host, network containment via API Elastic Security.
- Integrazione end-to-endTelemetria Elastic ingerita nella nostra data fabric multidominio.
FAQ · frequently asked
Everything to know before talking to our analysts.
What is the MDR service on Elastic Security?
Combines Elastic Security (SIEM + XDR + Endpoint) with the Fortgale SOC européen 24·7·365. L2/L3 analysts monitor the Kibana console, develop custom ESQL/EQL detection rules, apply MITRE-mapped runbooks and trigger response via Elastic Defend and integrations.
What advantages does Elastic offer over traditional SIEMs?
Elastic has a data-first model: no ingestion limits (resource-based pricing, not EPS), native multi-petabyte search, ability to develop detection rules in ESQL/EQL/KQL on any schema. Ideal for those who want flexibility and ownership of the security data lake.
Do I need to already have Elastic?
No. Fortgale handles the full cycle: Elastic Cloud or on-prem licensing, cluster deployment, Fleet integrations, detection rules development, tuning. Available both on existing instance or as part of the service.
Is the service NIS2-compliant?
Yes. We support NIS2 transposition requirements: monitoring continu, IoC collection for national CSIRT notification sous 24 heures, technical documentation for 72-hour notifications. Elastic's configurable retention supports NIS2 log retention requirements.
Does Elastic also cover endpoint and cloud?
Yes. Elastic Security includes: SIEM (log correlation), XDR (cross-domain analytics), Endpoint Security (Elastic Defend agent), Cloud Security Posture, Container Workload Protection. The Fortgale MDR service covers all these domains.
Parla con il presidio
Un incontro. Un NDA. Un runbook reale su Elastic.
Ti portiamo il Report sul tuo settore con gli attori più probabili e un runbook MDR concreto sulla tua console Elastic Security.