CYBERSECURITY · INVESTIGATIONS · ENGINEERINGDFIR · Detection engineering · Secure systems

Incident response.
Detection engineering.
Secure infrastructure.

Riveti Security investigates suspected compromise, develops SOC and SIEM detection capabilities, and delivers infrastructure and software projects. Work covers Microsoft 365, identity, networks, cloud, and operational technology.

Explore services Engagement details
AREAS OF PRACTICETECHNICAL SERVICES
Incident investigation.
Security engineering.
01DetectionSIEM data, rules and validation
02Identity & cloudMicrosoft 365 and Entra ID
03Networks & systemsArchitecture and secure deployment
04Incident responseInvestigation and recovery
Evidence analysis, detection logic, secure configurations, and documented handover.
Independent consulting or collaboration with your existing IT provider.Investigations · Engineering projects
SERVICES 01 Cybersecurity 02 IT & cloud 03 Engineering 04 OT security

Services

Cybersecurity and
systems engineering.

Investigate suspicious activity, improve security monitoring, or deliver a defined system change. Engagements can cover assessment, implementation, and validation, with findings, configuration records, or operating documentation specified in the scope.

CONSULTING · ENGINEERING · SUPPORT

CYBERSECURITY

DFIR & detection engineering

Investigate suspected compromise using endpoint artifacts, identity events, email records, and network telemetry. Establish activity timelines and support containment decisions. Develop and test detection rules against representative activity, documenting required telemetry, expected alerts, and known coverage gaps.

  • Incident readiness and response playbooks
  • Digital forensics and activity timelines
  • SIEM ingestion, parsing and alert tuning
  • Detection rules, testing and investigation workflows
Assessment, investigation and remediation
IT & CLOUD

Microsoft 365, identity & network security

Review how users, devices, applications, and administrators gain access. Address Microsoft 365 and Entra ID configuration, privileged access, endpoint controls, and network boundaries, with staged changes and validation of legitimate business access.

  • Entra ID roles, MFA and Conditional Access
  • Mailbox access and email security controls
  • Configuration assessments and prioritized remediation
  • Firewall rules, VPNs and network segmentation
Access review, configuration and validation
OPERATIONAL TECHNOLOGY

Operational technology security

Map connections between business networks, vendor access paths, and systems supporting physical operations. Review trust boundaries and recovery dependencies with operations personnel; plan changes around safety, availability, and maintenance constraints.

  • Asset, connectivity and dependency review
  • Vendor sessions and remote access controls
  • IT/OT zones, conduits and firewall review
  • Passive review and staged remediation plans
Security reviews coordinated with operations
ENGINEERING

Infrastructure & software engineering

Design and deploy network, server, virtualization, and cloud environments with explicit access boundaries, logging, and recovery requirements. Build automation, API integrations, and internal software for defined workflows, with deployment notes and maintainable source.

  • Network, server and cloud architecture
  • Migrations, backup and restore validation
  • Automation, API integration and tooling
  • Software delivery, testing and handover
Architecture, implementation and handover

Incident response & forensics

Prepare for incidents.
Investigate
the evidence.

Readiness work establishes evidence sources, log retention, collection procedures, decision authority, and response playbooks before an incident. Investigations correlate host, identity, cloud, and network evidence to establish what happened, what remains uncertain, and which containment and recovery actions are justified.

Investigation deliverables
INCIDENT RESPONSE SERVICESCOORDINATED RESPONSE
01

Assess

Triage reported activity, identify affected identities and systems, and record initial hypotheses

02

Preserve

Capture available artifacts, record sources and timestamps, and maintain collection and handling records

03

Contain

Coordinate account, endpoint and network controls while considering evidence and operational impact

04

Recover

Validate restoration, document the event timeline, and prioritize control and detection improvements

Containment, evidence collection, and recovery are coordinated as conditions require. Outputs can include an evidence inventory, activity timeline, findings with confidence and limitations, and an action log.

Environments

Business, cloud and
operational systems.

An identity change can affect business applications. A firewall change can interrupt production. Assessment and engineering work must account for the dependencies, access requirements, and consequences of changing each environment.

01

Business systems

Email, identities, endpoints, and business applications share access and recovery dependencies. Review how accounts are administered, where activity is recorded, and how a compromised identity could reach other systems.

Microsoft 365Identity controlsEndpoint security
02

Infrastructure & cloud

Servers, networks, and cloud resources depend on clear access boundaries, logging, and recovery procedures. Review architecture and configuration, identify migration dependencies, and validate agreed changes before handover.

ArchitectureMigrationsRecovery validation
03

Operational systems

Production systems depend on vendor access, network boundaries, and equipment that may be difficult to interrupt. Coordinate evidence collection and remediation with operations personnel, safety requirements, and maintenance windows.

OT assessmentsRemote accessNetwork segmentation

Engagements

What the work
delivers.

An investigation may produce an evidence inventory, activity timeline, and containment recommendations. A detection project may deliver tested rules and investigation playbooks. An engineering project may deliver deployed systems, source code, and operating documentation. The scope identifies which outputs are required.

Investigations can conclude with findings and recommendations. Implementation is included when agreed, with acceptance criteria and a documented handover.

01

Establish the problem

Agree the objective, systems, access, operating constraints, and acceptance criteria. Identify the evidence or design inputs needed to proceed.

02

Investigate, design or implement

Analyze evidence, develop the technical design, or implement approved changes. Record findings, assumptions, visibility gaps, dependencies, and configuration changes.

03

Validate and hand over

Validate findings or test approved changes against the agreed criteria. Confirm rollback requirements where relevant and provide the records needed to act on or maintain the result.

OUTPUTS DEFINED IN THE SCOPE

Statement of workEvidence and findingsPrioritized action planRunbooks and change records

Questions

Before an engagement.

Working alongside your team, protecting production systems, and defining the services included.

Do you work alongside an existing IT provider?

Yes. Riveti Security can provide independent assessments, specialist engineering, and defined project work alongside your internal IT staff or managed service provider. Access and responsibilities are agreed before work begins.

Are one-time projects available?

Yes. Engagements include one-time security assessments, infrastructure projects, incident investigations, and recurring support agreements. Services and commercial terms are established in advance.

How are production systems protected during an assessment?

Assessment methods and any required access are approved before work begins. Intrusive testing or changes affecting operational systems require explicit authorization and coordination with responsible personnel.

What does SOC and detection engineering include?

Work can cover log-source selection, ingestion and parsing, SIEM queries and correlation rules, alert tuning, investigation context, and response playbooks. Validation checks whether the required telemetry is present and whether a detection produces useful results. Ongoing alert monitoring and response coverage require a separately agreed scope.

Riveti Security

Define the problem.
Establish the next step.

Bring the suspected incident, detection gap, access concern, or engineering requirement. Riveti helps establish the systems involved, the evidence available, and the work needed. The engagement defines the deliverables and how the result will be validated.

Explore services