Sources · 10 June 2026
What to send us instead of administrator access
A source list for incident trend pictures that stays inside normal UK handling rules and does not require a login to your estate.
We do not take administrator credentials, VPN profiles, or a seat on your SIEM. That is not caution for its own sake. A briefing studio that holds keys becomes part of your estate, and the work we do does not need that.
What we do need is a summarised extract. A useful file has one row per event or ticket, with a timestamp, a detector or rule name, a severity as you already record it, a short disposition (open, closed, false positive), and an optional asset group. Hostnames can be replaced with a desk name or a site code if your policy prefers it. User names can be dropped.
Chat exports are welcome for a single-incident reconstruction if the chair already planned to use them in the after-action review. Strip channel names that would identify people who were only mentioned. Ticket dumps from Jira, ServiceNow, or a homegrown queue are enough for volume charts if the created and resolved stamps are trustworthy.
If an extract cannot leave the building, say so on the enquiry form. We can run a charting clinic on site and leave the files with you. The picture is the same; only the room changes.