Secure · Cybersecurity
Managed detection and response (MDR) and SOC services for Indian enterprises that need incidents found and contained, not only logged. NetScale onboards log sources and endpoints, tunes detection, then monitors and responds in the windows agreed in writing. Logs stay in India, and the CERT-In 6-hour report is written into the runbook.
Managed SOC and MDR
Managed detection and response (MDR) is a service that watches an estate for attacks and acts on what it finds.
Acting means isolating an endpoint or blocking an account, then working the incident with your team. Detection runs on EDR and XDR across endpoints, servers and the network, fed by logs kept in India. A threat model of your estate decides what to watch for. Penetration testing and phishing simulation show where an attacker could get in.
Monitoring and vulnerability management inside one managed services contract sit under Managed SOC.
Security awareness programmes for your whole workforce sit under Training and development.
A standalone vulnerability assessment and penetration test, with every fix retested, sits under VAPT.
Detection tools were installed years ago. Threats have changed since. If someone got in today, how soon would you know?
Our answer: EDR, XDR and MDR
An alert fires at 3 AM. Who is allowed to act on it?
Our answer: Incident response and digital forensics
Logs are collected and rarely read. What did last month’s show?
Our answer: Continuous monitoring and threat modelling
The last penetration test found problems. Who checked they were fixed?
Our answer: VAPT and penetration testing
Continuous monitoring, incident response, VAPT, EDR/XDR/MDR, digital forensics and awareness training.
Log sources, endpoints and network devices monitored against a threat model of your estate, in the window agreed in writing: business hours, extended or continuous.
Containment, investigation and recovery worked with your team, with evidence preserved for the CERT-In report and the post-incident review.
Endpoint detection and response on managed devices, extended to servers, network and email, with MDR acting on what it detects.
Vulnerability scanning and penetration testing of public-facing systems, VPN, websites, APIs and internal infrastructure, with every fix retested.
Simulated phishing campaigns and awareness sessions, with results reported by team so the next session goes where the clicks were.
Log sources, retention periods and India residency designed to the CERT-In Directions and the DPDP Rules, with clocks synchronised to NIC or NPL.
One detection path, endpoint to report, drawn three times.
You can stop at any phase boundary. The assessment is free, and each phase is priced in writing before it starts.How we engage
The Directions of April 2022 set a 6-hour reporting window, 180-day log retention within India and clock synchronisation. All three, and a named point of contact, are built into the runbook.
The DPDP Rules require one year of logs for personal data processing and breach intimation to the Data Protection Board and the people affected without delay, with a detailed report to the Board within 72 hours. Both are part of the incident path. Legal interpretation stays with your counsel.
Source: Digital Personal Data Protection Rules, 2025 (external site)
Where logs and alerts are stored is stated in the contract, in India.
NetScale is not a CERT-In empanelled auditor. Where a regulator requires an empanelled audit, we work alongside the auditor and fix what they find.
Endpoint and log-source count, and daily log volume.
Monitoring window: business hours, extended or continuous.
Response scope: alert and advise, or act on the estate.
Retention period and whether forensics and phishing simulation are included.
The most relevant engagement, with its numbers. Client names and the full write-up are shared in conversation.
Industrial manufacturing · Nine plants, seven cities
How a multi-site industrial company scoped a security programme across its network, devices, user access and sites.
Firewalls and secure networking
Next-generation firewalls and cloud security
Endpoint, firewall and managed detection
Endpoint protection
Vulnerability scanningOur own information security and privacy management systems, run under both standards.
Certifications and technologyA SOC as a service monitors and alerts. MDR also responds: contains the endpoint, blocks the account, works the incident with you. We offer both, and the right one depends on whether your team can act on an alert at 3 AM. The readiness review shows which fits your estate.
By writing the report into the runbook before an incident. Under the CERT-In Directions of April 2022, the 6 hours run from when the incident is noticed. The runbook names who confirms, who reports and what is sent. Log sources and time synchronisation are set up so the report carries evidence.
In India, for the retention period agreed in the contract: 180 days for CERT-In, and one year where the DPDP Rules apply. The location is written into the agreement. Where a regulator or your parent company sets a longer period, that period is written in instead.
Usually by buying monitoring as a service in defined windows, and agreeing in writing what the provider does when something is found. Start with the readiness review: it shows what you already log and what is missing. It is free, and the findings are yours.
Yes. Detection is built on the platforms you already run where they fit, and onboarded in fixed-scope phases. If you have a SOC partner, we can take a defined part, such as forensics or penetration testing, with the handover written down.
By what is watched and how: the log sources and endpoints onboarded, the monitoring window agreed in writing, and whether response is included. The assessment gives you a written cost model before any commitment, and each phase is fixed-scope and signed off separately.
Ask where your logs are kept, who owns the runbooks and configurations, which support window is written into the contract, and whether you can leave at any phase boundary. With NetScale, runbooks, configurations and credentials are yours, and you can stop at any phase boundary.
It costs nothing and commits you to nothing. You get a written list of where your IT environment is exposed, and your team can act on it with or without us.
