• by Admin

The Alert Fires at 2 A.M. Does Anyone Know What to Do?

An alert fires in the middle of the night. The analyst on duty sees something suspicious on a production server, but the runbook is out of date, the application owner is unreachable, and it is unclear who is allowed to isolate the machine. Twenty minutes go by on questions that should have been answered months ago.

Technology did not fail in that story. Preparation did.

Why Readiness Is Built Early

Cisometric's perspective on this is that incident response begins well before the incident. A SOC can only act quickly on what it can see and what it has rehearsed. That depends on decisions made much earlier: which logs are collected, how applications are built and deployed, and how clearly roles are defined when things go wrong.

This is where DevSecOps earns its keep. By bringing security into development and operations from the start, teams end up with systems that are easier to monitor, changes that are easier to trace, and people who already know each other when the pressure arrives.

This matters in Indonesia too. Financial institutions regulated by OJK, and organizations running critical systems under BSSN guidance, are already expected to show that they can respond to incidents, not just prevent them.

Rehearse the Bad Day

One of the most effective habits is also one of the least glamorous: practise. Run a tabletop exercise where a plausible incident is walked through step by step. Who gets called first? What can the SOC shut down without asking permission? Where are the logs that would answer the first three questions?

These sessions are often uncomfortable, because they expose missing contacts, unclear ownership and gaps in visibility. That discomfort is the point. Every gap found in a rehearsal is a gap that will not surprise you at 2 a.m.

A Calmer First Hour

That is the outcome Perkom and Cisometric aim for. Cisometric brings DevSecOps practice into SOC preparation, from knowing who owns which application to making sure the right logs are collected before anyone needs them. Perkom connects that work to the tools and teams you already have, so it does not turn into a separate project.

A tabletop exercise is a good first step. In a few hours it usually turns missing contacts and unclear rules into a short fix list, and the next time an alert fires, your team starts with a plan instead of a scramble.

Author: Ghea Devita, Marketing Communication PT Perkom Indah Murni