SOC & INCIDENT RESPONSE · MANAGED SERVICES
A working SOC without building one from scratch
A Security Operations Center designed, deployed and operated for you: use cases and log sources scoped, SIEM/SOAR deployed or onboarded, detection engineering, tiered L1–L3 monitoring, and monthly reporting and tuning — covering OT/ICS traffic as well as corporate IT, on an 8x5 or 24x7 model, and cutting the time an attacker spends undetected inside the network.
ENGAGEMENT AT A GLANCE
ScopeCorporate IT and OT/ICS traffic
Model8x5 or 24x7 managed
OutputOperated SOC + monthly reporting
YOU RECEIVE
Use-case and log-source scoping
SIEM/SOAR deployment, or onboarding of the platform you already run
Detection engineering, including OT-aware use cases
Tiered L1–L3 analyst monitoring
Monthly reporting and detection tuning
WHAT'S COVERED
Scope of the engagement
01
Use-case & log-source scoping
Which threats you need to see and which sources have to be onboarded to see them — decided before a single detection rule is written.
02
SIEM/SOAR deployment
A platform deployed from scratch, or your existing SIEM and SOAR onboarded and tuned — whichever your estate already has.
03
Detection engineering
Use cases built and tested against your environment, including Modbus- and DNP3-aware detections for industrial traffic.
04
Tiered monitoring
L1 triage through L3 investigation, on an 8x5 or 24x7 model — scoped to what your risk and your budget actually need.
05
Escalation & response
Confirmed incidents handed to the incident-response engagement, with the evidence already preserved and the timeline already started.
06
Reporting & tuning
Monthly reporting on what was seen and what was done, and tuning so the detections keep pace with the estate rather than with last year’s.
COMMON QUESTIONS
Before you ask
Do we have to buy a new SIEM?
No. The platform can be deployed from scratch or your existing SIEM and SOAR onboarded — scoping decides which, based on what you already run and what the use cases need.
8x5 or 24x7 — which do we need?
Both models are offered. Which fits depends on the threat profile of the estate and on what your own team already covers; it is a scoping decision and it is written into the proposal, along with what each model does and does not include.
Does it cover our OT network?
Yes. OT-aware detection use cases — Modbus- and DNP3-aware — are built for industrial traffic alongside the corporate IT sources. The same delivery model already runs in regulated financial-sector environments.
THE DELIVERABLE
What lands on your desk at the end
Before you sign, ask us exactly what the report contains — it is the fastest way to judge whether the SOC would tell you what you need to know.
REPORT CONTENTS
Use-case catalogue and log-source coverage map
Detection engineering record with test results
Monitoring runbooks and escalation procedures
Monthly report — alerts, incidents and actions taken
Tuning log and coverage changes
WHAT WE NEED FROM YOU
A named security owner and an escalation contact on your side
Access to log sources, or to the platform you already run
Network and asset documentation for IT and OT
The monitoring model and hours you want to contract
FRAMEWORKS THIS EVIDENCES
MITRE ATT&CKNIST Cybersecurity Framework (Detect)ISO/IEC 27001:2022 Annex A
Detections and reporting are mapped to these so coverage can be shown to an auditor rather than described.
Ready to secure your business?
Book a consultation with our engineers. Bring your architecture and your constraints — we'll tell you what we would do first, and why.
WHAT A CONSULTATION LOOKS LIKE
01
A conversation with an engineer
Not a sales call. Bring your architecture and your constraints.
02
A written gap summary
Prioritised, with what we would do first and why.
03
No obligation, no follow-up sequence
If it is not a fit we will say so on the call.
Not ready to talk? See the company facts — entity details, offices and our NTRA certification.
One inbox, answered by an engineer — not a routing queue.