XcellSecure|Security Case Management
Every incident gets an owner, a clock and a paper trail.
Alerts from your SIEM, EDR, email and firewall become one case. It is triaged by severity, worked through an agreed playbook, its evidence hashed and logged, and the regulator clocks — CERT-In's six hours first — tracked from the minute you notice.
Alerts tell you something happened. Cases make sure something is done.
A security case is the single record of an incident from first alert to closed review: what was seen, who owns it, how severe it is, what was done and when, what evidence was kept, and who was told. Case management is the discipline — and the tooling — that keeps every incident moving through that lifecycle the same way, every time.
Without it, incidents live in inboxes, chat threads and spreadsheets. Deadlines are missed because nobody started the clock, evidence is lost because nobody hashed it, and the same mistake repeats because nobody wrote the review. XcellHost runs case management inside our 24×7 SOC, connected to your SIEM, UEBA and NDR and to the ticketing tool your IT team already uses.
Built on NIST SP 800-61 Rev. 3 — the CSF 2.0 way.
NIST's April 2025 revision replaced the old four-phase model with the six functions of the Cybersecurity Framework 2.0. Preparation now sits in Govern, Identify and Protect; the incident itself runs through Detect, Respond and Recover — and lessons learned feed every function.
Source: NIST SP 800-61 Rev. 3, "Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile", April 2025, which supersedes Rev. 2 (2012). Checked on csrc.nist.gov, 10 November 2026.
Where a case comes from, and where it goes.
Hover or tap a stage. Case data stays in your Microsoft tenant or in XcellHost's Mumbai data centre.
Anything that can start an incident
Detections from the SIEM, endpoint and XDR alerts, UEBA risk scores and NDR findings, user-reported phishing, and reports from people — staff, partners, customers or an advisory from CERT-In itself.
- SIEM & XDR detections
- UEBA & NDR findings
- Phishing reports & people
Nine things every case gets, without anyone remembering to.
Grouping & deduplication
Alerts on the same user, host or indicator join one case instead of ten tickets.
Severity triage
Impact × urgency gives P1–P4, with the reason recorded so priority can be audited.
SLA timers
Acknowledge, contain and update targets per severity, with escalation before a breach.
Playbooks & SOAR
Step lists for ransomware, account takeover, data leak and phishing; repeatable steps automated.
Evidence & custody
Files, logs and images hashed on collection; every hand-off timestamped and attributed.
Regulator clocks
CERT-In six hours, DPDP Board and sector regulators — started from the time you noticed.
ATT&CK tagging
Each case tagged with the tactics and techniques seen, so patterns show across cases.
War-room & comms
Who was told what and when — management, legal, customers — kept on the case.
Post-incident review
Root cause, what worked, what didn't, and fixes tracked to closure.
The deadlines start when you notice — so the case starts the clock.
CERT-In directions, 28 April 2022
Specified cyber incidents must be reported to CERT-In within six hours of noticing them or being told about them. ICT system logs must be kept for a rolling 180 days within India.
DPDP Act, 2023 & Rules 2025
For a personal-data breach: tell each affected person and the Data Protection Board without delay, then send the Board a detailed report within 72 hours of becoming aware (the Board can extend this). Core duties apply from 13 May 2027.
RBI-regulated entities
Banks and other regulated entities report cyber incidents to RBI under their own directions — urban co-operative banks, for example, on the DAKSH platform within six hours of detection. Your case records the timeline they ask for.
SEBI-regulated entities
Market intermediaries follow SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), including incident reporting. We map its timelines into your severity matrix during readiness.
General information, not legal advice. Reporting obligations stay with your organisation; the CERT-In incident reporting retainer has XcellHost prepare reports with you. Confirm sector rules with your compliance team. Facts as on our phishing response, DPDP platform and UCB pages.
Tag every case. See the pattern, not a vanity score.
When analysts close a case they record the ATT&CK tactics observed. Over a quarter, that shows where attacks get furthest and which detections or controls to improve. Below is a sample quarter — click a tactic to see how cases are tagged. We don't publish coverage percentages.
Sample data. Tactic names from MITRE ATT&CK Enterprise v20 (October 2026). ATT&CK® is a registered trademark of The MITRE Corporation.
Drag cases through the lifecycle — and watch the clocks.
A sample board running on a simulated clock. Drag a card (or use its arrows) to move it. Acknowledging stops the response timer; reportable cases carry a CERT-In six-hour countdown until you mark them reported.
Illustrative SLA targets to acknowledge: P1 15 min, P2 30 min, P3 4 h, P4 24 h — your contract sets the real ones. Incidents, hosts and times are invented.
Work a playbook step by step, with evidence hashed as you go.
Pick a playbook and tick steps as they are done. Add an evidence note to any step: your browser computes a SHA-256 hash chained to the previous entry, like a custody log. Nothing leaves your browser; export the log as JSON.
- No evidence logged yet.
Chain: empty
Cases where your SOC works, tickets where your IT team works.
Partner products other than Microsoft are marked *; XcellHost is a Microsoft Gold Partner.
Your tenant or ours, our SOC on every case.
In your Microsoft tenant
Cases live in Microsoft Sentinel and Defender incidents in an Indian Azure region; we work them under delegated access.
On the XcellHost SOC platform
Case records and the evidence vault in our Mumbai Tier IV data centre, synced to your ticketing tool.
Co-managed
Your analysts and ours on the same case queue, with clear hand-offs by severity or hour of day.
Severity matrix, playbooks, contacts and regulator runbooks agreed — or review them with our vCISO.
01Sources into Managed Sentinel or a new Sentinel build; ITSM sync set up.
02Triage, containment and updates by Security Operations.
03User reports flow in from Phishing Incident Response.
04Forensics and recovery by our DFIR team when a case needs it.
05Monthly metrics — time to acknowledge, contain and close — and post-incident reviews.
06Get ready once, then let our SOC run the cases.
Case management is delivered inside Security Operations; the readiness pack and add-ons fit around it.
Incident-response readiness pack: the groundwork every case depends on.
- Severity matrix & SLA targets
- Four core playbooks
- CERT-In, DPDP & sector runbooks
- Contacts & approval chain
- One tabletop exercise
Cases opened, triaged, contained and closed by our 24×7 SOC, at the price on the Security Operations page.
- 24×7 triage & case handling
- SLA timers & escalation
- Evidence & custody records
- Post-incident reviews
- Monthly case metrics
XcellHost prepares CERT-In reports with you on reportable cases — as on the Managed Sentinel page.
- 6-hour assessment on each case
- Report drafted with your team
- 180-day log retention check
- DPDP & sector runbooks
INR, excluding 18% GST. Prices without * are the same as on Security Operations (₹199 Essential, ₹449 Professional per endpoint a month, ₹24,999 onboarding), Managed Sentinel, vCISO and Threat Intelligence (indicative there too). * Indicative — confirm with XcellHost: the ₹69,999 readiness pack, the ₹29,999 ITSM connector and the SLA targets used in the demo.
Endpoints, tier, add-ons. Total in rupees.
≈ ₹0 a month on average, excl. GST
Excl. 18% GST until the total line. * Indicative — confirm with XcellHost.Case management, answered.
In the middle of an incident? Call +91 22 6711 1555 or ask for help now.
It is the structured handling of every security incident as a single case — from the first alert through triage, containment, evidence, communication and regulator reporting to a closed post-incident review — so nothing depends on memory or a chat thread.
IT tickets track requests. A security case also groups related alerts, carries severity and regulator clocks, keeps evidence with hashes and custody, and restricts who can see sensitive details. We sync the parts IT needs to ServiceNow*, Jira* or Zoho Desk*.
NIST SP 800-61 Revision 3 (April 2025), which organises incident response around the CSF 2.0 functions — Govern, Identify, Protect, Detect, Respond and Recover. We map your sector's Indian rules onto it.
CERT-In's April 2022 directions count six hours from when you notice the incident or are told about it. That is why the case records the "noticed" time at intake and shows the countdown on reportable cases.
Under the DPDP Rules 2025 you must inform affected people and the Data Protection Board without delay and send the Board a detailed report within 72 hours of becoming aware. These duties apply from 13 May 2027. Our personal-data-breach playbook tracks both.
Evidence is hashed when collected, stored in an access-controlled vault in India, and every access or hand-off is logged with who, when and why. For legal matters our DFIR team follows forensic procedures; we advise you to involve counsel early.
Yes, for agreed steps — isolating a device, revoking sessions, blocking an indicator — through Sentinel automation and Defender. Steps with business impact wait for an approver you name.
No. Sentinel and Defender are the most common base, but we also work cases from partner SIEMs* or our own SOC platform. If you have no SIEM, Managed Sentinel is the quickest start.
Every case with its status, severity, timeline, actions and evidence list; updates at the cadence your severity matrix sets; and monthly metrics for time to acknowledge, contain and close.
Case handling is part of Security Operations — ₹199 (Essential) or ₹449 (Professional) per endpoint a month plus ₹24,999 onboarding. The readiness pack is indicatively ₹69,999* one-time and the CERT-In retainer ₹14,999 a month, all excluding 18% GST.