Logbook Security logging and incident response
A tamper-evident record of what happened, the tools to investigate it, and the reporting clock handled for you.
When something goes wrong, the questions come fast and they are always the same. What happened? What did it touch? Is it still happening? Do we have to tell anyone, and by when?
Logbook is built to answer them. Everything the platform observes (blocked connections, endpoint detections, configuration changes, sign-ins, remote sessions) lands in one searchable record that cannot be quietly edited afterwards. You can follow a single address, a single machine or a single account across the whole estate and see its story in order.
It also drives the response. An incident can be opened from a finding, assigned, worked and closed, with the evidence attached as you go. Where a response can be automated (isolate the machine, block the address, kill the session) it can be triggered from the same place, or set to happen on its own.
And it counts. NIS2 gives you 24 hours for an early warning, 72 for a full notification and a month for the final report; the maritime rules have their own expectations. Logbook tracks those deadlines from the moment an incident is opened, and drafts the notification content so the deadline is a form to approve rather than a night's writing.
What Logbook does
One searchable record
Network, endpoint, access and configuration events in one timeline you can pivot through.
Tamper-evident
The record is written so that later alteration is detectable, which is what makes it evidence.
Act, not just watch
Quarantine the file, block the address or end the remote session from the same place you found the problem.
The clock, handled
24-hour, 72-hour and final-report deadlines tracked, with the notification drafted for approval.
- A unified, tamper-evident event record across network, endpoints and access
- Investigation tooling that follows an address, machine or account across the estate
- Incident case management with evidence attached and actions recorded
- Regulatory notification drafts and deadline tracking for the 24h / 72h / 30-day clock
Incident handling, detection, response and the directive's reporting timelines.
And IMO maritime cyber resilience: IACS UR E26/E27
IACS UR E26 §4.4 + E27 item 13: incident response, network isolation, fallback to a minimal-risk condition, and audit records.
Works closely with
These are the capabilities Logbook shares its facts with.
Want to see Logbook on your own estate?
We will walk you through it against your actual sites, machines and obligations, and tell you where it would make no difference.