IR Playbook · Honest Scope
Emirtech helps Abu Dhabi and Al Ain organisations build a written incident response (IR) playbook covering detection, severity classification, escalation, containment, and recovery. We document the workflow and integrate Microsoft Sentinel SOAR — we are not a DFIR firm and do not perform active incident response.
Get a free site survey Talk to a specialist
In short: This page covers “Incident Response Playbook — Honest Scope” from the technical side, with honest scope. Emirtech installs and configures systems; it is not an auditor, certification body or legal adviser, so confirm the standard or regulation with the relevant authority, auditor or adviser.
| Who provides it? | Emirtech Technology, based at M44, Mussafah Industrial Area, Abu Dhabi, in operation since 2018. The work is carried out by Emirtech's own engineers. |
|---|---|
| Where? | Abu Dhabi and Al Ain, served from Emirtech's Mussafah, Abu Dhabi base; there is no Al Ain office. In Dubai: IT AMC and time attendance by scheduled on-site visits, gate barriers, ANPR, video intercoms and turnstiles by Emirtech itself; CCTV, alarm and access control through SIRA-approved partners, with Emirtech coordinating. |
| What is covered | Incident Response Playbook — Honest Scope. |
| Survey and quotation | Emirtech publishes no price list: it surveys or assesses first and then gives a written, itemised quotation. |
| Credentials | Emirtech is an independent systems integrator. It holds no manufacturer-level credential of its own, and its ADMCC approval covers security systems only, not IT services. |
| Please note | General information, not legal, audit or certification advice. Emirtech is not an auditor, certification body or legal adviser; confirm the standard or regulation with the relevant authority, auditor or adviser. |
| Last reviewed | 21 October 2026 |
Emirtech Technology is a commercial IT and security integrator (ADMCC-approved for security systems) founded in 2018 and based at M44, Mussafah Industrial Area, Abu Dhabi. We help customers in Abu Dhabi and Al Ain build a documented incident response (IR) playbook that defines how their internal IT team and external partners react when a cybersecurity incident is suspected. Scope includes detection criteria sourced from Microsoft Sentinel, Microsoft Defender XDR, Sophos Central, SentinelOne Singularity or CrowdStrike Falcon alerts; severity classification using a four-tier P1/P2/P3/P4 scheme aligned to business impact; escalation path covering internal IT lead, executive sponsor, external DFIR retainer firm, customer notification, and any regulator notification the customer's legal counsel directs. We document containment actions (isolate host via EDR, disable user account in Microsoft Entra ID, block indicator at firewall), evidence preservation steps (forensic disk image via FTK Imager or X-Ways, log export from Sentinel and Defender, chain-of-custody form), eradication, recovery, and post-incident review templates. Where the customer uses Microsoft Sentinel, we build supporting Logic Apps SOAR playbooks that automate routine response steps such as user disablement, host isolation, and ticket creation in ServiceNow or Jira. Honest positioning: Emirtech is not a Computer Security Incident Response Team (CSIRT) provider, not an Authorised Cybersecurity First Responder (CFR), and not a Digital Forensics & Incident Response (DFIR) firm. For active incident response, malware reverse engineering, ransomware negotiation, advanced forensic analysis or threat-actor attribution, the customer engages a specialist DFIR firm such as Mandiant, CrowdStrike Falcon Complete, Sophos Rapid Response, KPMG Cyber or PwC Cyber under separate contract. We are not SIRA-licensed, not ISO 27001 certified, not NESA/ADHICS certified, and not a 24/7 SOC operator. We hold no manufacturer-level credential of our own. To discuss IR playbook development for your Abu Dhabi or Al Ain site, call +971 55 651 7843 or email [email protected].
Playbook Capabilities
Documented alert sources from Microsoft Sentinel analytics rules, Defender XDR incidents, Sophos Central, SentinelOne or CrowdStrike Falcon, with triage decision tree and false-positive filters tuned to the customer environment.
Four-tier severity scheme covering P1 critical (active ransomware, data exfiltration), P2 high (confirmed malware on production), P3 medium (single endpoint compromise), P4 low (policy violation, suspicious login), each with target response time.
Named contacts and escalation thresholds for internal IT lead, executive sponsor, external DFIR retainer, legal counsel, customer/regulator notification triggers — customer legal counsel directs any regulator notification decision.
Step-by-step containment runbooks (EDR host isolation, Entra ID account disable, firewall block) and evidence preservation guidance (forensic image, log export, chain-of-custody) for handover to specialist DFIR firm.
Organisations without a written playbook can discover during an incident that nobody owns the response decision, the EDR isolate button has never been tested, and the DFIR firm phone number is not written down. Emirtech delivers a documented IR playbook that names owners, lists actions, and ties into your existing Microsoft Sentinel or EDR tooling. To start playbook development, call +971 55 651 7843 or request a free IR playbook consultation.
Integration & Tooling
Logic Apps playbooks for automated user disablement via Microsoft Entra ID, host isolation via Defender for Endpoint API, indicator blocking and incident enrichment from threat intelligence connectors — built where the customer already licenses Sentinel.
Containment procedures documented for Microsoft Defender for Endpoint, Sophos Intercept X, SentinelOne Singularity or CrowdStrike Falcon — host isolation, process kill, indicator block — tested during playbook commissioning.
Incident records routed to ServiceNow ITSM, Jira Service Management or Freshservice with severity, owner, evidence links and post-incident review fields — using the customer's existing ticketing platform.
Facilitated tabletop walkthrough of one P1 ransomware scenario and one P2 phishing-compromise scenario to validate decision points, contact accuracy and EDR action steps before the playbook is signed off.
Emirtech is transparent about IR playbook scope so customers in Abu Dhabi and Al Ain know exactly which work we perform in-house and which work belongs with a specialist Digital Forensics & Incident Response firm under separate contract.
If you need active monitored response, retain a specialist DFIR firm or a managed security service provider. Emirtech's role is to ensure the playbook, the tooling integration and the tabletop rehearsal are in place before that retainer is ever activated.
Common questions
No. Emirtech is not a Digital Forensics & Incident Response (DFIR) firm, not a Computer Security Incident Response Team (CSIRT) provider, and not an Authorised Cybersecurity First Responder (CFR). We help customers document an IR playbook and integrate it with Microsoft Sentinel SOAR and their EDR — for active incident response, evidence-grade forensics or threat-actor attribution, the customer engages a specialist DFIR firm such as Mandiant, CrowdStrike Falcon Complete, Sophos Rapid Response, KPMG Cyber or PwC Cyber under separate contract.
No. Emirtech is not affiliated with Mandiant (Google Cloud), CrowdStrike Falcon Complete, Sophos Rapid Response, Microsoft DART, KPMG Cyber, PwC Cyber, Deloitte Cyber, FIRST.org or SANS DFIR. Customers select and contract a DFIR retainer firm directly. We document the contact details, escalation thresholds and handover pack in the playbook so the firm can be engaged quickly when needed.
No. Emirtech is not SIRA-licensed (SIRA is a Dubai regulator and Emirtech operates in Abu Dhabi and Al Ain), not ISO 27001 certified, not NESA or ADHICS certified, and not a 24/7 SOC operator. Our credentials are ADMCC approval for security systems work and Control4 installation through a third-party dealer for residential automation. If your tender requires a certified provider, retain a certified firm and use Emirtech for playbook documentation and tooling integration only.
The playbook documents notification triggers, candidate timeframes and a recommended internal decision flow, but the final decision to notify any regulator (such as a sector regulator or the customer's data protection authority) is taken by the customer's legal counsel. Emirtech is not a law firm and does not provide breach-notification legal advice. The playbook is structured so legal counsel can make the call quickly with the right facts in front of them.
Microsoft Sentinel Logic Apps automation is the most common path because Sentinel ships with native connectors for Defender XDR, Entra ID and Microsoft 365. If the customer uses a different SIEM or no SIEM, the IR playbook is delivered as a documented runbook only and containment actions are performed manually in the EDR console (Sophos Central, SentinelOne Singularity or CrowdStrike Falcon). Emirtech does not build custom SOAR integrations for non-Microsoft SIEMs.
Call +971 55 651 7843, email [email protected] or request a free IR playbook consultation. We will arrange a scoping discussion covering your detection stack, EDR platform, named escalation contacts and any existing DFIR retainer, and return a fixed-scope quotation for the playbook, Sentinel SOAR build and tabletop exercise.
IR Playbook · Honest Scope
Free site survey · transparent scope · honest costs · ADMCC-approved for security systems · Mussafah M44 home base since 2018.
Need a free Abu Dhabi site visit? Call +971 55 651 7843 or email [email protected] — we reply the same working day across Abu Dhabi and Al Ain.