Kit · Operations
Environment onboarding kit
Bringing a new environment under monitoring. Seven steps, in order — and a verification stage at the end, because coverage assumed is coverage absent.
- Trigger
- New environment or major system
- Final step
- Prove the detections fire
Step 1 — asset inventory
You cannot monitor what nobody has counted.
Steps 2–5 — collection design and build
Decide the method per device class, then build and prove the flow.
Steps 6–7 — detections, alerting and proof
The last step is the one most often skipped, and it is the only one that proves any of the previous six worked.
Onboarding ends with evidence, not with a green tick
“The agent is deployed” is not coverage. “We ran twelve atomic tests, nine were detected, and here are the three we are accepting and why” is coverage. The second version is also the one that survives a supervisory conversation.
Next kit
Service catalogue kit
Define what the SOC actually offers: service lines, tiers, coverage windows, response targets, and the demarcation from IT service desk.