When to call us

Logs are collected but nobody reads themMicrosoft 365 and firewall logs expire unread.
You want to know about foreign sign-ins the same dayAccess from an unexpected country or device, flagged within hours.
Too many alerts to readExisting tools notify constantly and the important ones get buried.
A device stops reporting and nobody noticesSilence was mistaken for "no problems".
Not the size for your own SOCNo 24-hour team, but daily review is still needed.
After an incident, you want faster detectionTurn the entry path from the investigation into a detection rule.

What it does

  • Log sources:Microsoft 365 and Entra ID, Google Workspace, AWS (CloudTrail, VPC flow logs, GuardDuty), firewall and VPN appliances, Windows and Linux servers, web servers and e-commerce sites.
  • Read-only connection:SecureWatch reads from your log platform. Nothing runs on your servers except detection rules you can inspect. Your logs stay on your systems.
  • AI triage:Every alert is enriched with geolocation, network ownership and threat intelligence, then prioritised. You receive the few findings that matter, explained in plain language.
  • Daily report:Opens with a coverage check, then new and ongoing findings and recommended actions, in English and Japanese.
  • Real-time alerts:High-severity events in Teams or email within minutes, with the context needed to act.
  • Response support:Confirmation of what was detected and first-step advice. Where a full investigation is needed, it hands over to our incident response service.

Silence is never mistaken for safety. Every report opens with a coverage check: which log sources reported and which devices went quiet.

How an engagement runs

  1. Connection and tuning (onboarding)Agree the log sources and set up the read-only connections. Tune the detection rules, set up the reports and alert channels, and develop parsers for any non-standard logs. Monitoring starts once everything is verified in your environment.
  2. Detection rulesCommon attack patterns plus rules tuned to your environment. You can inspect the rules at any time.
  3. AI triageEvery alert prioritised with its enrichment; only what matters is kept.
  4. Daily reportEvery morning: coverage and findings, in English and Japanese.
  5. Real-time alertsHigh-severity events notified within minutes, with first-step advice where needed.

What you receive

  • Daily report in English and Japanese
  • Real-time alerts for high-severity events (Teams, email)
  • Monthly summary: detection trends, coverage, recommended improvements
  • List of detection rules and their change history
  • First-step advice in an incident and handover to the investigation service

Built and operated in Japan by CS2. Your data does not leave the country.

Indicative pricing

Starting pointMonthly feeThe monthly fee is set by the number of services and log sources monitored: Microsoft 365 or Google Workspace, firewall and VPN appliances, servers, AWS or Azure accounts and e-commerce sites each count as a source. Onboarding is a customisation and tuning period: detection rules, reports and alert channels, and parsers developed for any non-standard logs. It is quoted by the number of sources and the parser work involved. Scope and price are fixed before monitoring starts.

Frequently asked questions

What does it cost?

SecureWatch is charged monthly, based on the number of services and log sources monitored. Onboarding (connections, rule tuning, parsers for non-standard logs) is quoted separately by the number of sources. Tell us which services and how many devices you have and we will quote the monthly fee and the onboarding.

Where are our logs stored?

On your systems. SecureWatch connects read-only and handles only what the analysis needs. It is operated in Japan by CS2 and your data does not leave the country.

Is it 24/7?

Monitoring and automated real-time alerts run around the clock. Human review and advice are during business hours by default; out-of-hours response depends on your contract.

Does it overlap with our existing tools or vendor?

SecureWatch runs on top of your existing log platform. It does not replace your firewall or EDR; it reads their logs and makes the judgement.

Can you work in both English and Japanese?

Yes. Meetings, reports and management briefings are available in English and Japanese, so a foreign head office and the Japanese team can work from the same findings.

Who responds after a detection?

First-step advice is part of SecureWatch. Containment and recovery are shared with your IT staff or vendor. A full investigation hands over to our incident response service.

Start by telling us which logs you have.

Microsoft 365 or Google Workspace, roughly how many devices and servers, and whether you run an e-commerce site is enough for a quote.

Contact