Netbase Solution Services · Any segment
Help when a device on your network looks compromised
The AdminKit compromised-device incident response service gives you Netbase engineers when a device on your network is behaving like it has been compromised. We triage what happened, help you contain the device without losing evidence, and agree the next steps with you, remotely and as quickly as the scope allows.
- Delivered by
- Netbase JSC
- Engagement
- Per incident
- Pricing
- Custom quote
Updated · AdminKit team, Netbase JSC
Who is this service for?
- Homes and shops with an unexpected device behaviour
- Small offices after a suspicious alert
- Any segment, without in-house security staff
What does Netbase deliver?
Every engagement starts from a written scope. This is what it covers, what it does not, and what can be added.
Supported
- Routers, cameras, tills, PCs and other devices on your own network
- Reviewing logs and unfamiliar IP addresses or domains
- Isolating the device while keeping evidence
- A written summary and next steps
Not included
- Forensic work for legal proceedings
- Negotiating with attackers
- Investigating systems you do not own or control
Extra services
- A home or shop security check once the incident is closed
- Small office network and mail configuration
- Protective DNS to log what devices try to reach
How does an engagement run?
First contact
Tell us which device and what you noticed.
Scope and quote
What we look at and how we work together.
Triage and containment
Evidence kept, the device isolated with you.
Recovery and lessons
Next steps and fixes agreed and written down.
What do you get at the end?
- A triage summary: which device, what it did, what it reached
- Containment steps agreed with you and applied
- A list of what to change so it does not happen the same way again
- Notes you can hand to your insurer, IT provider or management
Who delivers this service?
Netbase Enterprise Solutions and Applications Joint Stock Company (Netbase JSC)
- Netbase JSC was founded in 2012.
- Netbase JSC has served 500+ clients.
- Netbase has worked with clients in 80 countries.
- Every service is delivered remotely, so clients in any country and any industry can engage.
- Contracts and invoices are issued by Netbase JSC; payment goes to the company by bank transfer to Netbase JSC's company account or PayPal Business.
Which AdminKit products and tools does this build on?
Netbase engineers use the same AdminKit checks you can run yourself for free, so you can see the starting point and re-check the result after handover.
What are you responsible for?
Every engagement runs on a written scope of work with a responsibility matrix: what Netbase JSC commits to and what stays with you. Changes to scope are agreed and re-quoted before work continues. Contracts and invoices are issued by Netbase JSC. Automated AdminKit checks used along the way are advisory, as described in the disclaimer.
Talk to an expert
Huy Nguyen (David), Founder & CEO, Netbase JSC
Ask about Compromised-device incident response: scope, timing or a quote.
Frequently asked questions
Should I switch the device off?
Disconnecting it from the network is usually safer than switching it off, because powering off can erase evidence held in memory. If you are unsure, disconnect the network cable or Wi-Fi and talk to our team before doing more.
What information helps you start quickly?
What the device is, what you noticed and when, and any alerts, logs or unfamiliar IP addresses you have seen. Screenshots are fine.
Is the work done remotely or on-site?
Around 90% of AdminKit expert work is remote. On-site visits are the exception and are quoted separately, after the scope is agreed.
How is incident response priced?
It is quoted per incident once we understand the scope. There is no fixed public price.
Talk to our team about this service
Tell us what you run and what you need. We scope it with you first, then send a quote.