TotalHealIncident ResponseIncident Response Services
A block of incident-response hours a year, with a named lead, a hotline and TotalHeal agents ready to deploy. When an incident starts, we scope it, contain it, collect the evidence and help you report it — and unused hours can go into readiness work.
Why organisations ask for it
An incident is the worst time to find a responder, agree a contract and get their tools onto your network. A retainer settles all of that in advance, so the first hour is spent containing the attack, not on paperwork.
Terms agreed in advance
Scope, rates and the response target are in the retainer, so work starts with one call.
Tools ready to deploy
TotalHeal agents go on affected systems for visibility, containment and evidence collection with EvidenceLens.
Evidence on record
Each collection is recorded with who asked, when, from which device and its integrity hash — a chain of custody for insurers and auditors.
Reporting on time
The facts for your CERT-In report within its 6-hour clock, and for DPDP notices.
What our team does
Triage
- Take the first call and agree the immediate steps
- Scope affected systems, accounts and data
- Decide containment with you
Contain and investigate
- Deploy ThreatTrace on affected Linux servers and ThreatGuard on laptops; isolate or quarantine as needed
- Take volatile-state snapshots — running programs, network connections, startup items — with EvidenceLens
- Rebuild the attack timeline and find the way in
Recover
- Remove the attacker’s access and persistence
- Guide restores from clean recovery points
- Watch for a return during the recovery period
Report and learn
- Prepare the facts for CERT-In and DPDP filings
- Write the incident report: cause, impact, actions, timeline
- Recommend changes so it does not happen again
Your price — order and pay
Prices in Indian rupees, GST extra. Paid in advance: pay online, ask for a payment link, or take a proforma for your purchase order. Onboarding starts within one working day of payment.
- Work starts once payment clears
- Containment, forensics and recovery
- Report for management and regulators (CERT-In)
A larger or custom scope? Size it for a quote
Several sites, special coverage hours or extra add-ons: enter your estate and choices, see the scope and the TotalHeal licences it needs, and send it to us — we reply with a quote.
What you receive
Hotline
A number and an e-mail that reach the incident lead.
Situation updates
At the interval you agree with us, to the people you name.
Incident report
Root cause, impact, timeline, actions and recommendations, with the evidence index.
Readiness work
Tabletop exercise, incident-response plan review or a compromise assessment.
Runs on TotalHeal products
The service works in your own TotalHeal console, on products that are available today.
How an engagement runs
Order and pay — or ask for a quote
Choose the plan and size on this page and pay in advance (online, a payment link or a proforma for your purchase order); for a custom scope, size it below and we send a quote. Either way you get the written service terms: coverage hours, response targets and runbooks.
Give consent
Your administrator accepts TotalHeal’s provider link in your own console. Until then we have no access. Every action we take is recorded in your audit trail and ours, and you can end the link at any time.
Onboard
We enrol agents, connect your sources, agree the escalation contacts and the actions we may take without asking, and tune the policies to your environment.
Run
The service runs in your TotalHeal console, so you see exactly what our analysts see and do, as it happens.
Report and review
Scheduled reports by e-mail and PDF, and a regular review with your team of what happened, what was done and what to change.
What we need from you
- Named people who may declare an incident
- A current network and system overview
- Emergency access arrangements agreed in advance
- Your insurer’s incident requirements, if you have cyber insurance