The incident trend briefing is the piece of work most organisations ask for first. It is not a live wall of alerts. It is a still picture of a period that already happened, drawn so that a security lead can sit with finance, legal, or an operations director and point to when the noise rose, which detectors fired together, and which weeks were genuinely quiet.
We start from your own extracts. Typical inputs are a SIEM export with timestamps and rule names, a ticket dump from the incident queue, or a spreadsheet the on-call rota already keeps. We map those rows onto a small family of charts: volume by day, severity bands, repeating source pairs, and a short list of incidents that broke the usual pattern. Captions state what the chart shows and what it does not. If Friday nights are empty because logging was paused, the caption says so.
The walkthrough is part of the fee. We spend ninety minutes on the pack with the people who will reuse it, answering which spike belongs to a known change window and which one still needs a sentence in the next board note. After that, the files are yours to reprint. We do not retain a live feed into your estate.
Who it is for
Security leads, SOC managers, and incident commanders in UK organisations who already collect events but need a clear picture for colleagues who do not live in the logs.
What you receive
A dated briefing pack of charts and captions that shows incident volume, severity bands, recurring sources, and quiet periods — plus a ninety-minute walkthrough so the pack can be used in a real meeting.
Scope
One agreed time window (typically a quarter), named event sources, a severity mapping you already use or that we draft with you, and a fixed set of chart views listed at kickoff.
Included
- Kickoff call to lock the window, sources, and questions the pack must answer
- Review of summarised event extracts (CSV, SIEM export, or ticket dump — not live access to your estate)
- Draft chart set with captions written in plain English
- One revision round against your comments
- Final PDF pack and slide-ready figures
- Ninety-minute remote walkthrough for up to eight attendees
Not included
- Around-the-clock monitoring or on-call cover
- Operating your SIEM, EDR, or ticket queue
- Expert-witness statements or court-ready forensic reports
- Raw packet capture or malware reverse-engineering
Who prepares it
Prepared by Contenttrailcore from the studio at 25 Main Rd, Ford, with walkthroughs held remotely across the United Kingdom or on site by arrangement.
Sequence
- Intake form and source list
- Window and severity mapping agreed in writing
- Draft charts issued for comment
- Final pack and walkthrough booked
Time
Three to four weeks for a first quarterly pack once extracts arrive. Repeat quarters usually take two to three weeks if sources stay the same.
Where the work happens
Remote across the UK as standard. On-site walkthroughs in England and Wales by arrangement; travel is billed separately.
What to prepare
You supply de-identified event summaries: timestamps, source or detector names, severity, and a short disposition where you have one. We do not need administrator credentials.
Limits we will not blur
We chart what you already collect. Gaps in logging stay visible as gaps; we do not invent counts to fill empty hours.
Fees
From £4,800 excluding VAT for the first quarterly pack. Repeat quarters from £3,200 when the chart set is unchanged. On-site days are quoted after the postcode is known.
Next step
Use the enquiry form and name the window you want charted. We will say whether the extracts you have are enough before any fee is due.