Managed Security
Services Workflows

SOC ALERT TRIAGE — AUTOMATED ENRICHMENT ════════════════════════════════════════ DAILY ALERTS: 12,456 across 234 MSSP customers AUTO-TRIAGED: 10,234 (82.2%) — no analyst needed TRIAGE RESULTS: False Positive — Auto-Closed (8,901 alerts): Domain: PageRank > 4.0, age > 2 years, legitimate category Example: employee visiting linkedin.com flagged by overly strict rule Low Priority — Queued (1,333 alerts): Domain: PageRank 1.0-4.0, age 30-365 days, ambiguous category Example: new SaaS tool not yet whitelisted High Priority — Escalated (2,222 alerts): Domain: PageRank < 1.0, age < 30 days, suspicious/uncategorized Example: newly registered domain, possible C2 communication ANALYST TIME SAVED: Before automation: 45 min avg per alert × 12,456 alerts = 9,342 hours After automation: 45 min × 2,222 escalated alerts = 1,667 hours Efficiency gain: 82.2% — saving 7,675 analyst hours/day

CUSTOMER THREAT PROFILE — SIAM COMMERCIAL BANK ════════════════════════════════════════ CUSTOMER: scb.co.th (Siam Commercial Bank) SECTOR: Financial Services | COUNTRY: Thailand THREAT LANDSCAPE (LAST 30 DAYS): Phishing domains targeting Thai banks: 456 (+23% MoM) Specifically targeting SCB brand: 34 domains Banking trojans in Thailand: 89 new samples Ransomware targeting Thai finance: 12 campaigns CUSTOMER-SPECIFIC SIGNALS: scb.co.th impersonation domains: 34 (up from 28 last month) Employee-targeted phishing: 12 campaigns (persona: finance staff) Supply chain risk: 2 vendor domains with degraded security posture Web Filtering change: 1 partner domain reclassified as suspicious

MSSP PARTNER MATURITY ASSESSMENT ════════════════════════════════════════ PARTNERS ASSESSED: 234 Sangfor MSSP partners globally MATURITY TIER DISTRIBUTION: Tier 1 — Elite (23 partners): /security: SOC 2 + ISO 27001 | /case-studies: 10+ | /careers: SOC roles PageRank > 5.0 | Domain age > 5 years | 24/7 SOC capability Examples: Ensign InfoSecurity (SG), NTT Security (JP) Tier 2 — Professional (67 partners): /security: ISO 27001 | /case-studies: 3-10 | Some SOC roles PageRank 3.0-5.0 | Domain age > 3 years Tier 3 — Developing (89 partners): /security: Basic certifications | Few case studies PageRank 1.0-3.0 | Domain age 1-3 years Tier 4 — At Risk (55 partners): No /security page | No case studies | No SOC capability PageRank < 1.0 | May not meet Sangfor quality standards

MDR INVESTIGATION — CASE #MDR-2026-0217-4521 ════════════════════════════════════════ CUSTOMER: Malaysian Insurance Company ALERT: Suspicious outbound data transfer to unknown domain DOMAIN: cloud-document-storage.asia DOMAIN INTELLIGENCE (instant enrichment): Age: 8 days Country: Hong Kong (hosting) / Unknown (registrant) PageRank: 0.1 IAB Category: None Web Filtering: Newly Observed Domain Personas: None detected Pages: 1/20 (only fake /login page) ENRICHMENT VERDICT: Confidence: 96.8% MALICIOUS Pattern: Data exfiltration staging domain Similar to: 12 other domains in same infrastructure cluster RECOMMENDATION: ISOLATE endpoint, block domain, full investigation

PRE-ONBOARDING ASSESSMENT — NEW CUSTOMER ════════════════════════════════════════ PROSPECT: tokopedia.com (Indonesian e-commerce) SECURITY POSTURE BASELINE: /security page: Present — ISO 27001 certified /compliance page: Present — PCI DSS compliant /login page: MFA + SSO detected Domain age: 15 years — Established PageRank: 6.8 — High authority Web Filtering: E-commerce — Properly categorized EXISTING THREATS DETECTED: Brand impersonation domains: 89 active phishing domains Competitor scraping bots: 23 domains scraping pricing data Employee-targeted phishing: 12 domains targeting @tokopedia.com ONBOARDING PRIORITY: Immediate: Block 89 phishing domains Week 1: Deploy brand monitoring for new impersonations Week 2: Baseline traffic analysis complete

MULTI-TENANT THREAT CORRELATION ════════════════════════════════════════ CUSTOMERS MONITORED: 234 enterprises COORDINATED ATTACK DETECTED: CAMPAIGN: "Southeast Storm" Same malicious domain cluster hitting 12 customers simultaneously Domains: 23 newly registered (age < 5 days, all from same registrar) Targets: All financial services customers in Thailand and Indonesia Attack vector: Spear-phishing via fake regulatory notification AFFECTED CUSTOMERS: Customer A: Thai Bank — 45 phishing emails detected Customer B: Indonesian Fintech — 23 phishing emails Customer C: Malaysian Insurance — 12 phishing emails + 9 more financial services customers CORRELATION SIGNALS: Same domain registrar, same hosting ASN Domain names follow pattern: [bank-name]-regulatory-[year].xyz All domains: PageRank 0.0, age < 5 days, no legitimate pages

COMPLIANCE MONITORING — MSSP CUSTOMERS ════════════════════════════════════════ CUSTOMERS: 234 enterprises across 15 APAC countries COMPLIANCE STATUS: Compliant (156 customers): /compliance page current, /security certifications valid /legal privacy policy updated, proper data handling At Risk (56 customers): /compliance page outdated or missing certifications /legal page not updated for recent regulatory changes Missing /security trust center page Non-Compliant (22 customers): No /compliance page despite regulatory requirements /legal page violates PDPA/MLPS requirements Cross-border data flow without proper consent pages

UPSELL OPPORTUNITY ANALYSIS — MSSP CUSTOMERS ════════════════════════════════════════ OPPORTUNITIES IDENTIFIED: NGAF Upsell (67 customers): Currently on basic firewall, showing cloud migration signals /careers: Cloud architect roles | /api: New API development Opportunity: NGAF upgrade with cloud integration Endpoint Secure Expansion (45 customers): Growing endpoint count detected via /login portal changes /careers: Remote work roles increasing | New /api pages Opportunity: Additional endpoint licenses Brand Protection Add-on (34 customers): Multiple brand impersonation domains detected High PageRank customers with valuable brands Opportunity: Brand monitoring service add-on Compliance Service (22 customers): Non-compliant or at-risk status detected New regulatory requirements in their region Opportunity: Compliance monitoring add-on

INCIDENT CLASSIFICATION — AUTOMATED ════════════════════════════════════════ CLASSIFICATION RULES: PLAYBOOK: Phishing Response Trigger: Domain age < 7d + Web Filtering "Phishing" + /login clone Actions: Block domain, isolate endpoint, scan email, notify user PLAYBOOK: Malware Containment Trigger: Domain age < 30d + PageRank < 0.5 + Country risk Actions: Block domain, isolate endpoint, full forensic scan PLAYBOOK: Data Exfiltration Trigger: Unusual data volume + Domain age < 90d + no IAB category Actions: Block domain, preserve logs, escalate to analyst PLAYBOOK: Shadow IT Trigger: Domain has /login + Web Filtering "Cloud/SaaS" + not whitelisted Actions: Log, notify IT admin, add to review queue AUTOMATION RATE: 78% of incidents auto-classified and playbook-triggered Average time to first response: 2.3 minutes

MSSP MARKET OPPORTUNITY — APAC ════════════════════════════════════════ ENTERPRISES WITHOUT SECURITY MATURITY (by region): Indonesia: 8,901 enterprises | Current MSSP coverage: 12% Vietnam: 6,789 enterprises | Current MSSP coverage: 8% Philippines: 5,678 enterprises | Current MSSP coverage: 10% Thailand: 4,567 enterprises | Current MSSP coverage: 18% Malaysia: 3,456 enterprises | Current MSSP coverage: 22% FASTEST GROWING DEMAND: Indonesia: +34% YoY (PDP law driving compliance) Vietnam: +28% YoY (Decree 13 + FDI growth) Philippines: +23% YoY (BPO sector security requirements)