SOC as a Service

Flow chart of the SOC as a Service engagement, 6 phases in order, each one selectable. Phase 1, Onboarding and Log Sources. We connect your endpoints, servers, cloud and network to our monitoring platform, and agree what good and bad look like for your business. Activities: Connect log sources and validate parsing for each one; Baseline normal activity across users, servers and cloud; Agree severity levels and escalation contacts; Set log retention to match your compliance obligations. Hands over Onboarding Runbook and Log Source Inventory. Phase 2, Detection Tuning. We tune detection rules to your environment so real threats stand out and noise is filtered away. Fewer false alarms means faster response to the alerts that matter. Activities: Tune detections against MITRE ATT&CK coverage; Suppress known-good behaviour that generates repeat noise; Write custom rules for your business-specific applications; Validate each rule with simulated attack activity. Hands over Tuned Detection Ruleset. Phase 3, 24/7 Monitoring and Triage. Our analysts watch alerts around the clock. Each one is triaged, confirmed or dismissed, and escalated to you only when it needs your attention. Activities: Triage every alert against the agreed severity matrix; Enrich alerts with threat intelligence and asset context; Escalate confirmed threats to your named contacts; Track time to detect and time to respond for each case. Hands over Triage Log with Response Times. Phase 4, Threat Hunting. We proactively hunt for attackers who slip past automated detection, using threat intelligence and behavioural analysis to find what alerts miss. Activities: Form hunt hypotheses from current threat intelligence; Search historical telemetry for matching behaviour; Investigate anomalies in authentication and outbound traffic; Convert successful hunts into permanent detections. Hands over Threat Hunt Findings. Phase 5, Incident Response. When we confirm an incident, we contain it, guide your team through the response and help you recover, following an agreed IR playbook. Activities: Isolate affected hosts and revoke compromised credentials; Run the agreed IR playbook with your technical team; Preserve evidence for later forensic review; Guide recovery and confirm the attacker is out. Hands over Incident Report with Root Cause. Phase 6, Monthly Reporting. You get a clear monthly report covering what we saw, what we stopped, how fast we acted and where you can reduce risk further. Activities: Summarise alert volume, confirmed incidents and outcomes; Report detection and response times against agreed targets; Show ATT&CK coverage gained and gaps remaining; Recommend the next changes to reduce risk. Hands over Monthly SOC Report. Each phase begins from the artefact the phase before it produced.