01 ·
Splunk ES · top Gartner SIEM
Notable events, risk-based alerting, MITRE ATT&CK mapping. Native data ingestion from any source via Universal Forwarder. Risk-based alerting for noise reduction up to 90%.
MDR sur Splunk Enterprise Security: leading SIEM, custom SPL rules.
The Fortgale SOC européen 24·7·365 on the Splunk ES console. SPL detection rules tuned on European TTPs, ~11 min median containment, response orchestrated via Splunk SOAR.
Fortgale × Splunk
MDR · live
Sensore Splunk attivoTelemetria endpoint · cloud · identità
Splunk SOC italiano 24·7·365Analisti L2/L3 · interlocuzione diretta
Fortgale Tier-zero AI multidominioRumore ridotto del 94%
Fortgale Risposta nativa SplunkIsolamento host mediano ~8 s
Live Intelligence proprietaria34 000+ IOC settimanali · attori italiani
Fortgale MDR operativo — Splunk + Fortgale SOC attivi
Conformità
ISO/IEC 27001
NIS2 ready
DORA aligned
GDPR · ACN
Partnership tecnologica
Splunk Enterprise Security
MITRE ATT&CK aligned
OpenCTI
Pourquoi Fortgale + Splunk
The Gartner-leading SIEM, operated with proprietary CTI.
Splunk Enterprise Security is the Gartner Leader SIEM/SOAR for the 11th consecutive year. Fortgale l'opère avec analystes européens who develop custom SPL detection rules on European actor TTPs.
02 ·
SOC européen 24·7·365
L2/L3 analysts develop custom SPL rules and ES content packs tuned on European TTPs. Triage <15 min on notable events. Threat hunting on Splunk Search using proprietary CTI.
03 ·
Splunk SOAR + IR
Custom playbook orchestration via Splunk SOAR: cross-tool response, automatic enrichment, ticketing. Escalade directe to Fortgale IR. Accompagnement complet à la notification CSIRT national NIS2 notification.
Comment ça marche · architecture
Quatre blocs, un cycle MDR on Splunk.
From data ingestion to SOAR response — le tout gouverné par Fortgale with analystes européens and proprietary CTI sur les marchés européens.
01 ·
01 · Ingestion
Data sources active
Splunk Cloud or on-prem with all data sources connected: endpoint, firewall, AD, M365, AWS/Azure, custom apps. Universal Forwarder + HEC + APIs.
02 ·
02 · Tier-zero
Custom SPL detection
ES content packs + custom SPL rules tunés par Fortgale on European actor TTPs. Risk-based alerting reduces noise by 90%, only real notables reach analysts.
03 ·
03 · Analysts
Nos L2/L3 sur la console
European SOC spécialisés sur Splunk. Triage on notable events, hunting via Splunk Search, attribution to actor. Interaction directe dans votre langue business.
04 ·
04 · Response
SOAR playbook + IR
Containment via Splunk SOAR custom playbooks: EDR isolation, AD lockout, firewall block, ticketing. Escalade directe to Fortgale IR for incidents critiques.
Proof · metriche del servizio
Quattro numeri che reggono l'MDR su Splunk.
Metriche misurate sulla telemetria reale dei nostri clienti — Q1 2026, aggiornate trimestralmente.
~11 min
Confinement médian
from confirmed notable
from confirmed notable
90 %
Bruit réduit
par risk-based alerting
par risk-based alerting
Custom
SPL rules MITRE-mapped
on European TTPs
on European TTPs
14 days
Onboarding complet
Splunk ES + SOAR
Splunk ES + SOAR
Ce que comprend le service
MDR sur Splunk, en détail.
Every component designed to leverage Splunk ES with European SOC governance and proprietary CTI.
01
Managed Splunk ES
Splunk Cloud or on-prem licensing (or existing instance). Indexers, search heads, data sources, ES content packs managed by Fortgale. Continuous tuning.
02
Custom SPL detection
Custom SPL rules MITRE ATT&CK-mapped, tuned on European actor TTPs. Risk-based alerting. New rules deployed monthly based on the threat landscape.
03
Proprietary CTI in Splunk
34,000+ IoCs per week from Fortgale OpenCTI auto-imported into Splunk Threat Intelligence Framework. Lookup tables for SPL detection.
04
Splunk SOAR + IR
Custom SOAR playbooks: cross-tool containment, automatic enrichment, ticketing. Escalade directe to Fortgale IR team for incidents critiques.
05
Reporting & governance
Executive reports with MTTD, MTTR, alert volume, risk score trend. Custom Splunk Glass Tables. NIS2/ISO 27001/GDPR audit documentation.
06
Threat hunting on Splunk
Monthly hunting on Splunk Search using proprietary CTI + Sigma rules. Focus on silent lateral movement, persistence, data staging not covered by automatic detections.
Per chi · due angolazioni
Stesso MDR su Splunk, due angolazioni.
Il CISO decide sul rischio. Il responsabile IT decide sul runbook. MDR Fortgale produce evidenze per entrambi.
Per il CISO
Un runbook nominativo per attore, su stack Splunk.
Il CISO riceve ogni mese il profilo dei 3 attori più probabili contro il proprio settore, con il runbook MDR Fortgale già mappato sulla telemetria Splunk Enterprise Security.
- Threat briefing mensileAttori, TTP osservate, campagne in corso sul vostro settore.
- Runbook su SplunkPlaybook vivi mappati MITRE, eseguibili sulla console Splunk Enterprise Security.
- Reporting board-readyRischio · impatto · decisione. Niente tecnologia da slide.
Per il responsabile IT
Zero handover traduttore. Analisti italiani sulla vostra console Splunk.
Quando l'alert Splunk è reale, il tempo di decisione è il tempo di contenimento. I nostri analisti L2/L3 conoscono la console Splunk Enterprise Security e hanno mandato di decidere.
- Contenimento mediano ~11 minDall'alert confermato alla remediation in produzione.
- Risposta nativa SplunkKill processi, isolamento host, network containment via API Splunk Enterprise Security.
- Integrazione end-to-endTelemetria Splunk ingerita nella nostra data fabric multidominio.
FAQ · frequently asked
Everything to know before talking to our analysts.
What is the MDR service on Splunk Enterprise Security?
Combines Splunk Enterprise Security (Gartner Leader SIEM) with the Fortgale SOC européen 24·7·365. L2/L3 analysts develop custom MITRE-mapped SPL detection rules, monitor ES notable events, orchestrate response via Splunk SOAR and apply proprietary runbooks.
Do I need to already have Splunk?
No. Fortgale handles the full cycle: Splunk Cloud or on-prem licensing, indexer/search head deployment, data sources integration, ES content packs, tuning. Available both on existing instance or as part of the service.
Does the service include Splunk SOAR?
On request, yes. Splunk SOAR (formerly Phantom) is available as add-on module for playbook orchestration, cross-tool integration and response automation. The Fortgale SOC develops custom playbooks mapped to runbooks.
Is the service NIS2-compliant?
Yes. We support NIS2 transposition requirements: monitoring continu, IoC collection for national CSIRT notification sous 24 heures, technical documentation for 72-hour notifications. Splunk's configurable retention supports NIS2 log retention requirements.
Is Splunk only for logs or does it have XDR/EDR capabilities?
Splunk Enterprise Security is SIEM. For XDR/EDR it combines with Splunk Attack Analyzer and add-ons/integrations with third-party EDR (CrowdStrike, SentinelOne, Defender). Fortgale orchestrates the entire stack.
Parla con il presidio
Un incontro. Un NDA. Un runbook reale su Splunk.
Ti portiamo il Report sul tuo settore con gli attori più probabili e un runbook MDR concreto sulla tua console Splunk Enterprise Security.