Onboard Alder Creek Veterinary
58 people, Standard plan, brought by Corvid IT Partners. Imani Brooks started this at 14:20. You confirm the detections and response policy in step 5.
Proof of life
A step is finished when its events arrive, not when a form is submitted
Step 1 of 6Tenant details and planConfirmed
Tenant created at 14:20, storage and key ready at 14:21
Alder Creek's events go to their own data store, encrypted with their own key. Nothing is shared with another tenant.
What was entered
- Organisation
- Alder Creek Veterinary
- Tenant id
- alder-creek-vet
- Primary domain
- aldercreekvet.example
- People
- 58
- Sites
- 1, the main clinic
- Partner
- Corvid IT Partners. The portal and reports carry Corvid's brand.
- Plan
- Standard
- Monitored by
- Dual Path SOC, around the clock
- Signed
- Mon 9 Nov 2026, order form countersigned 14:12
What DPSIEM created5 of 5 confirmed
- Tenant record14:20:06
- Separate data store14:20:41
- Tenant encryption key14:20:44
- Collector address 192.0.2.44:651414:21:02
- Agent enrolment token14:21:03
Step 2 of 6Connect Microsoft 365 and Entra IDConfirmed
First audit events received at 14:31, 412 so far
338 from Microsoft 365 audit and 74 from Entra ID sign-ins. Admin consent was granted at 14:28 by Imani Brooks, Corvid's delegated Global Administrator. The first event followed 3 minutes later.
Three most recent event typesEach one is normalised and the raw event is keptSearch these events
| Received | Event type | Normalised as | From |
|---|---|---|---|
| 14:47:52 | UserLoggedIn | Authentication | Entra ID sign-ins |
| 14:47:31 | FileAccessed | File activity | Microsoft 365 audit |
| 14:47:09 | MailItemsAccessed | Email activity | Microsoft 365 audit |
Read access7 permissions, none can change anythingGranted 14:28
AuditLog.Read.AllSign-in logs and directory audit logs from Entra IDActivityFeed.ReadExchange, SharePoint, OneDrive and Teams audit eventsSecurityAlert.Read.AllAlerts raised by Defender and Entra ID ProtectionIdentityRiskEvent.Read.AllRisky sign-ins and risky usersDirectory.Read.AllNames of people, groups, devices and apps, so an alert can say who and whatPolicy.Read.AllConditional access policies, to explain why a sign-in was allowedMailboxSettings.ReadInbox rules, to spot rules that hide or forward mailGranted to the multi-tenant app DPSIEM Collector. To withdraw it, delete that app under Enterprise applications in Entra ID. Events stop within a minute and this step goes back to listening.
Response accessOptional, a separate grantNot granted
Monitoring works without this. With it, DPSIEM can act inside Microsoft 365 during an incident. Without it, an analyst phones the customer and they act themselves.
It is asked for separately so the customer agrees to write access on purpose. Every use follows the response policy in step 5 and is logged, and withdrawing it later does not affect monitoring.
User.RevokeSessions.AllSign a person out everywhereUser.EnableDisableAccount.AllDisable an account, and enable it againUserAuthenticationMethod.ReadWrite.AllRequire MFA to be registered againMailboxSettings.ReadWriteRemove a malicious inbox ruleDelegatedPermissionGrant.ReadWrite.AllRevoke an app's OAuth grantWaiting for the customer to agree. Request sent to Lena Whitcombe at 14:29, opened 14:41, no answer yet.
Step 3 of 6Deploy the endpoint agentArriving
37of 58 devices reporting
Listening for 21 more. The latest check-in was ACV-EX-04 at 14:47:38.
The component DPSIEM Agent 1.8.2 ran as a quick job on the Datto RMM site Alder Creek Veterinary at 14:36. The enrolment token travels as a site variable, so nobody types it.
Targeted55Reporting37Still installing12Queued until switched on6
A Win32 app assigned to a device group. Slower to land than Datto RMM: Intune installs at each device's next check-in, usually within the hour.
dpsiem-agent.exe /quiet /token=acv-enr-8F2K-Q7TD-41MN
Detection rule: the service DPSIEMAgent is running. Not used for Alder Creek, because every managed device is already in Datto RMM.
For the 3 devices that are not in Datto RMM. Run it in an elevated PowerShell window on each one.
irm https://get.dpsiem.example/agent.ps1 | iex; Install-DpsiemAgent -Token acv-enr-8F2K-Q7TD-41MN
The enrolment token works only for Alder Creek Veterinary, for up to 58 devices, and expires on Mon 16 Nov.
Checked in most recently8 of 37See all 37
| Device | Used by | Checked in | Events |
|---|
What those 37 are sending14,206 events so far, the 3 most recent
| Received | Event type | Normalised as | Device |
|---|---|---|---|
| 14:47:58 | Process created 4688 | Process activity | ACV-FD-02 |
| 14:47:57 | Account logged on 4624 | Authentication | ACV-SRV01 |
| 14:47:55 | Script block logged 4104 | Script activity | ACV-LT-007 |
Not seen yet21 devices
| Device | Why not yet |
|---|
The count of 58 is the 55 devices in Datto RMM plus 3 seen only in Entra ID. The 12 that are installing do not need you, so carry on while they check in.
Step 4 of 6Point the firewall at the collector
Waiting for the first event
Nothing has arrived from this site yet. The collector has been listening on 192.0.2.44:6514 since 14:21, 27 minutes with no connection.
First event received at 14:48, 26 so far
From 198.51.100.212 over TLS 1.3, parsed as SonicWall Enhanced Syslog. Latest: a blocked inbound connection on X1, normalised as Network activity.
What the collector is listening forIn the order it will happen
There has been no connection attempt at all, so the settings have probably not been entered yet. A wrong port or an untrusted certificate would show up here as a failed attempt, with the reason.
All four confirmed. The 16 network detections and the 8 cross-source detections can arm now.
Events for this tenant are accepted only from 198.51.100.212, the clinic's public address. Anything else is dropped and reported here.
Enter these on the SonicWallTZ 370, SonicOS 7
In SonicOS open Device, Log, Syslog, then choose Add under Syslog servers.
| Name or IP address | 192.0.2.44 | |
| Port | 6514 | |
| Server type | Syslog server | |
| Syslog format | Enhanced Syslog | |
| Syslog facility | Local use 0 | |
| Syslog ID | acv-main | |
| Transport | TCP with TLS on, 1.2 or later | |
| Trusted certificate | DPSIEM Collector CA | |
| Log level | Inform, all categories |
Mock control
Step 5 of 6Choose detections and the response policy
Baseline pack133 detections, kept as code and versionedReview the rules
| Group | Detections | Right now | On |
|---|
Response policy
| Action | Who decides |
|---|
Four of these run through Microsoft Graph and need the response access from step 2. Until the customer grants it, an analyst phones Lena Whitcombe and she acts herself. Nobody is named yet to approve out of hours.
Step 6 of 6Invite customer contacts and schedule reportsNot started
No one has been invited yet
This step is confirmed when a contact signs in to the portal, not when the invitation is sent.
ContactsThey see the portal under Corvid's brandPreview their portal
| Invite | Name | What they get |
|---|---|---|
| Lena Whitcombe Practice manager | Approves response actions, weekly summary, monthly report | |
| Dr. Samuel Oyelaran Owner | Monthly report, phoned for a critical incident | |
| Imani Brooks Technician, Corvid IT Partners | Every alert for this tenant, weekly summary, portal administration |
ReportsSent as PDF and kept in the portalSee a sample
| Report | When | On |
|---|---|---|
| Weekly summary | Mondays 08:00, first on 16 Nov | |
| Monthly report for the owner | 1st of the month, first on 1 Dec | |
| Quarterly review with Corvid | First on 9 Feb 2027 |
ActivityWho did what on this onboarding, newest firstEvidence arrived Someone did something