Ongoing service plan
SOC
From threat detection to incident containment
Analysts connect signals from your environment, assess threats and perform approved actions to limit their impact. The service manages incidents through to agreed closure.
Core scope
What is included in the SOC plan?
Threats are analysed, assigned priorities and owners, and addressed through approved containment actions, including outside your organisation’s working hours.
The plan also includes the agreed scope of:
Security source integration
Connecting agreed logs and alerts from endpoints, servers, identity systems, network devices, email, cloud and applications. Normalising data required for analysis.
Telemetry coverage and quality checks
Checking that covered sources provide data, agents work and integrations remain correct. Identifying and addressing visibility gaps within service responsibility.
Maintaining detection and correlation rules
Deploying and tuning scenarios appropriate to available telemetry and the customer’s environment, such as suspicious logins, privilege changes and process activity.
24/7 alert triage
Verifying alert context, credibility and significance. Distinguishing false positives from events requiring investigation and assigning priorities.
Incident analysis and scoping
Investigating related accounts, devices and events. Reconstructing the available timeline, searching covered sources for indicators of compromise and assessing identified impact.
Threat containment
Performing pre-authorised actions such as endpoint isolation, indicator blocking, access restriction or session revocation, where deployed tools and permissions allow.
Standard threat eradication actions
Performing actions available through agreed tools, such as quarantining malicious files or removing an identified unauthorised access mechanism. Higher-impact changes follow the appropriate approval path.
Coordinating further remediation
Preparing tasks for the customer or S&VM, tracking completion and verifying outcomes in available telemetry. Managing the case through agreed closure, rather than ending with a message.
Preserving basic operational evidence
Retaining relevant logs, alerts, exports and action records. Documenting sources, collection times and analytical limitations.
Using threat information
Enriching analysis with available information on campaigns, indicators of compromise and attacker techniques. Updating standard detections as new information emerges.
Playbook maintenance and readiness tests
Updating procedures after incidents and environmental changes. Periodically checking selected detections, escalation channels and approved response mechanisms.
Incident communication and documentation
Informing authorised contacts about the event, handling status and required decisions. Preparing an incident report and technical data supporting the customer’s further reporting and assessments.
Reporting and security improvement
A monthly summary of incidents, detection quality, handling times and open recommendations. Implementing agreed improvements to rules, integrations and procedures.
Working together
Clear scope. Agreed actions.
Responsibilities are documented in the service specification, alongside assets, tools, permissions and escalation paths.
- Response includes pre-authorised actions supported by agreed tools. Higher-impact activities follow the appropriate approval path.
- SOC does not automatically include all NOC outages, complete infrastructure rebuilding, unlimited digital forensics or arbitrary administrative work.
- Searching for related traces during incident analysis is included. Additional hunting campaigns conducted independently of alerts require an agreed extension.
- When work exceeds SOC scope or permissions, we identify the appropriate provider and coordinate next steps. An incident occurring does not turn core handling into an additional service.
- We document actions and provide technical data for further customer assessments and reporting. Full GRC services and other organisational obligations need a separate scope.
We define the SLA for starting work separately from incident containment and service restoration time. 24/7 operation does not guarantee availability of customer systems.
Service onboarding
Before we begin handling events.
We agree the scope
We inventory assets, data sources, service owners, contacts and expected outcomes.
We connect and configure
We activate standard integrations, access, alerts and procedures appropriate to the selected plan.
We verify readiness
We test telemetry, escalation and approved actions, and agree acceptance criteria and the start of operations.
Standard implementation is part of onboarding and may carry a separate setup fee. Dedicated connectors or application code changes are agreed as separate work.
Choose a plan
Frequently asked questions
Is containment included in the core SOC service?
Yes. Core SOC includes analysis, incident management and pre-authorised containment, such as endpoint isolation, indicator blocking or session revocation. Execution depends on deployed tools, access and the agreed authority matrix.
How does incident analysis differ from additional threat hunting?
Incident analysis searches available sources for related traces and establishes scope. Advanced Threat Hunting is a separate campaign with agreed hypotheses, sources and boundaries, which can run without a current alert.
Does SOC include fixing outages and rebuilding all IT?
SOC coordinates security incident handling but does not automatically take over all maintenance or infrastructure rebuilding. NOC handles outages, Enterprise combines operations, and extensive recovery or additional resources are agreed separately.
Related expertise
Connect activities that complement each other.
The next step
Let us define a scope that makes sense for your organisation.
Let us discuss your environment, priorities and team responsibilities. We will use this to define the work, required access and service conditions.