Services

Managed SOC: someone watching, even when you are not

Security tools raise alerts. The trouble is that almost nobody reads them, and an attack that starts on Friday evening is discovered on Monday morning. A managed SOC is the watch that is missing: event collection, analysis by people, and action when it is needed.

Talk to us 02 9609324

The point is not the tool, it is who watches it

Almost every company we look after already had a firewall and antivirus before we arrived. What they did not have was somebody who, at two in the morning on a Saturday, noticed that an account was behaving strangely. The difference between an incident and a disaster is almost always time: hours, not days.

A managed SOC does not add yet another console to check: it takes the checking off you. Events end up in the SOC, which is on watch 24 hours a day: they are read by whoever is on shift, not by whoever happens to look. We are the part that knows your infrastructure — what can be isolated and what cannot, who has to be called, what happens next — and we remain your single point of contact.

What we actually do

Six ongoing activities, not a product to install

Collection and correlation

Logs from firewalls, servers, workstations, Microsoft 365 and VPNs end up in one place and are correlated: on their own they say nothing, together they tell a story.

Detection

Rules and models recognise what does not add up: a login from abroad at three in the morning, an account trying a hundred passwords, a server that starts talking to an address never seen before.

Triage

The part no software does on its own: an analyst looks at the alert, at any hour, and decides whether it is a false positive, a distraction or a real attack. This is where having tools differs from having someone on watch.

Containment

When it is a real incident we act: isolate the workstation, block the account, close the wrong firewall rule. Before the problem spreads.

Proactive hunting

We do not just wait for the alert: we actively look for traces of silent compromises, the ones that sit still for weeks before moving.

Tuning

Every false alarm is wasted time: the rules are tuned to your environment, so whoever is watching stays alert instead of getting used to the noise.

When an alert goes off

The path is always the same, and it is agreed beforehand

Alert raised

The alert is raised automatically by the monitoring systems, at any hour.

Analysis

A SOC analyst picks it up — at night, on a public holiday — reconstructs what happened and sets the severity.

Containment

If needed we act immediately to stop it spreading, and we tell you what we are doing while we do it.

Recovery and lesson

Normal service is restored and the hole they came through is closed, so it does not happen again.

What reaches you

A service you cannot see risks looking pointless: that is why it is measured

A regular report

What was detected, what was closed, what is still open and why. Written to be read by non-technical people too.

The metrics that matter

How many alerts, how many were real, how long it took to pick them up and to close them. Numbers that over time tell you whether you are improving.

The things to fix

Monitoring brings structural weaknesses to the surface: machines that are not up to date, permissions that are too broad, accounts left active. We flag them in order of risk.

Someone to talk to about it

A point of contact who knows your infrastructure, not a generic support form.

Who is on watch, and in which hours

It is the question everybody asks: here is the full answer

Monitoring runs 24 hours a day, 7 days a week, all year round, and that is not a figure of speech: the service runs on the Barracuda SOC, whose partners we are, with teams of analysts across the United States, Europe and Asia handing over the shift as the day moves. There is no hour of the year when nobody is watching.

What we do is everything else, and it is not little: we decide what to collect, connect your systems, tune the rules to your environment, receive the escalations and put our hands on the infrastructure — because it is yours and we know it. Nobody asks you to explain your network in English to a SOC abroad: we are the ones you talk to.

24 hours a day, 365 days a year

Analysts on shift every hour of the year, not a system that sends emails and hopes somebody opens them. An attack that starts on a Friday evening does not wait until Monday.

Response times by severity

The response times stated by the SOC are 20 minutes for high-risk alerts, with a phone call when the case is serious, one hour for medium-risk ones and eight hours for minor ones.

Containment agreed in advance

For serious cases the action starts immediately, without waiting for authorisation; for minor ones it is logged and dealt with together. Which cases fall into which category is decided when the service starts, not during the emergency.

Frequently asked questions

Antivirus or EDR blocks what it recognises, and does it well. The trouble is the cases where it does not block but flags, or blocks only one link in a longer chain: if nobody reads that alert, it stays there. A SOC is exactly the human part that is missing: somebody who looks at the alerts, puts them in order and decides.

The size that matters is not the headcount but how long you would be stopped without your systems, and what your data is worth to somebody else. A thirty-person firm making to order can have more to lose than one with two hundred. The scope of the service is sized accordingly.

Monitoring runs 24 hours a day, 7 days a week, all year round: the watch is the Barracuda SOC’s, whose partners we are, with analysts handing over the shift between the United States, Europe and Asia. The response times stated by the SOC are 20 minutes for high-risk alerts, one hour for medium-risk ones and eight hours for minor ones. We work Monday to Friday, 9.00–12.30 and 13.30–18.00: we receive the escalations, call you and work on your infrastructure. For serious cases, though, containment starts immediately at any hour, as agreed when the service starts.

Whatever was agreed at activation applies: for serious cases containment starts immediately, without waiting for authorisation, and you are informed; for minor ones it is logged and dealt with when you reopen. The two categories are defined together beforehand, not during the emergency.

It is the operational side of the same subject. The Security & SOC solution describes the technologies we put in place — EDR/XDR, log collection, correlation. This page describes the ongoing service: who watches, how often, what happens when an alert goes off and what reaches you each month.