Triminus

Your night. Our day.

NightOps APAC

Core service hours on a Swiss working day. For you as a security provider in Asia-Pacific, that day falls on your night: a person on your queue, in your tenant, under your runbooks.

The arithmetic

Your out-of-hours window, 22:00 to 06:00 local time, expressed in Swiss time:

Example: a New Zealand night inside the Swiss working day. Actual windows and scope are set per partner.
Your market Your 22:00–06:00 in Switzerland What the Swiss day covers
New Zealand 10:00–18:00 in the Swiss winter, 12:00–20:00 in the Swiss summer The whole night
Australia (east) 12:00–20:00 in the Swiss winter, 14:00–22:00 in the Swiss summer The night to roughly 04:00 local

The offsets move with daylight saving on both sides. Shifts are therefore contracted in your local time, never in Swiss time.

New Zealand and Australia come first. Japan, Hong Kong and Singapore follow.

Three levels

Each level includes the one before it. Whatever a level does not cover is escalated to you, not acted on. The levels are starting points: the runbooks, escalation criteria and action matrix are agreed with you. So are the response targets. Acknowledgement times depend on severity, and you set what counts as critical or high.

Already running automated or agentic triage? Its overnight escalations go to Triminus: investigation and scoping, plus containment within your action matrix on Respond.

  1. Monitor

    Watches your console in your tenant. Acknowledges and classifies alerts, suppresses known-benign alerts per your runbooks, and wakes your on-call by your criteria.

  2. Investigate

    Monitor, plus enrichment and investigation: account and endpoint context, log pivoting, scoping of a suspected compromise, and a written case file per incident.

  3. Respond

    Investigate, plus containment actions from an action matrix targeted to your needs and processes.

Where the work happens

In your tenant, with scoped accounts, under your runbooks. No data leaves your platform, no custody of your customers’ data.

Some examples of the tools:

SIEM

  • Elastic
  • Splunk
  • Wazuh

Endpoint

  • Microsoft Defender
  • Palo Alto Cortex

Cases and threat intel

  • TheHive
  • MISP

OT

  • Claroty

Ask for the full list, or bring your own.

This can include OT monitoring, where your platform covers it.

The Shift Ledger

Every shift ends with a written handover: handled alerts, decisions taken, progress on previous handover items, and anything deliberately left for your day team. It reaches you at a fixed handover time, set to match your day team’s schedule.

Specimen Shift Ledger — level Respond, one night, New Zealand local time
Time Reference Event Decision and reason
22:00 SL-0000-01 Shift start. Handover note from the day team read. Two open items carried over.
23:17 SL-0000-02 Sign-in from an unfamiliar location, user in the finance group. Classified benign. Matches the travel notice in runbook entry R-14. Closed.
01:42 SL-0000-03 Endpoint alert on WS-EXAMPLE-07: script interpreter started by an office document. Investigated. Process tree and file hash recorded in the case file. Scope: one host.
01:58 SL-0000-03 Same case. Host isolated. Action matrix item A-3 permits isolation of a workstation.
02:01 SL-0000-03 Same case. On-call woken, as required by the escalation criteria for any containment action.
03:30 SL-0000-04 Repeated failed sign-ins against a service account. Not covered by the runbook. Escalated, not acted on.
06:00 SL-0000-05 Shift end. Left for the day team: SL-0000-03 re-imaging decision, SL-0000-04 review.

Getting started

It starts with a conversation about your nights, not a contract for all of them. No need to hand over every night on day one.

  1. A first call to see whether Triminus fits. Bring what you have, however vague.
  2. Scoping with you: your platform, your runbooks, your escalation criteria, and what is most needed for your nights.
  3. Onboarding in your tenant: scoped accounts, your runbooks walked through together, and on Respond, the action matrix signed.
  4. A start with a few nights a week.
  5. More nights, or a higher level, once the Shift Ledger and the escalations have proven themselves on both sides.

Once onboarding is complete, partners can ask for extra capacity at short notice, for a surge or an incident.

Commitments

The exact terms follow your local law and your set-up.

  • You own the client relationship. White label, unless you decide otherwise.
  • Neither Triminus nor its founder solicits your customers, during the term and for 12 months after.
  • Work only inside your platform, no copies, your data-handling rules. Your local legal obligations stay with you, and the scope is set to fit them.
  • Local data protection law applies and is part of the individual service agreement.
  • Triminus works from Switzerland. Where your customers restrict access from abroad, this is settled in scoping, before any onboarding.

Limits

  • Triminus does not provide coverage at all hours. Coverage is contracted in shifts, on the nights you choose, in your local time. Outside the contracted shifts your own on-call arrangement applies.
  • Triminus acts only within your runbooks and the action matrix you have signed. An action that is not listed leads to an escalation.
  • In OT by default: monitoring, investigation and escalation. No containment on control systems. Containment can be added to the action matrix as the partnership grows.
  • No negotiation with attackers, including in ransomware cases.