SISA Compromise Assessment

Compromise Assessment is a service offered by SISA that identifies indicators of compromise within an organization's IT environment to determine whether a breach has occurred, even in the absence of known incident indicators. The service follows a five-point methodology consisting of scoping and objective setting, data collection, threat detection and analysis, incident validation and impact assessment, and a final summary of findings with recommendations. Data collection is performed using SISA IR agents, firewall traffic logs, and SIEM exports spanning at least one month. The assessment covers endpoint analysis (workstations, servers, mobile devices, system logs, file integrity, and EDR data), network traffic analysis (firewall and IDS/IPS logs to detect data exfiltration or C2 activity), and log aggregation and analysis (correlating logs across servers, network, and security devices to identify anomalies). Detection techniques include IoC scans, behavior analysis, threat intelligence, and dark web scans to uncover intrusions, malicious activity, or data exposure. The engagement produces a report including an executive summary, evidence documentation, risk prioritization matrix, IoC and TTP analysis, activity timelines, affected systems, and remediation steps. Reporting is aligned to regulatory frameworks such as RBI, PCI DSS, and ISO 27001.