Service · Cybersecurity

SOC monitoring

Taken separately, small oddities rarely look alarming. Put together, they can read like a crime report. Imagine an export business in Podravje. Early one Monday, someone logs in to the finance lead's mailbox from another country. Hours later an invisible inbox rule starts sending every “bank” message to an external mailbox. Two days on, an overseas customer is emailed fresh payment instructions. Three different systems, three separate logs, and not one alarm. A single analyst looking at all three together would have locked the account long before any payment was made. Joining those dots is what a Security Operations Centre does. Sign-in, mailbox, perimeter, server and endpoint data flow into one platform, detections shaped around how your business normally behaves run against it, and a human examines every hit. Once an incident is confirmed, we execute the playbook you signed off earlier, from suspending the user to revoking sessions and quarantining machines. Few SMEs could staff their own SOC, so ours runs entirely remotely.

Unified telemetry
cloud, network, servers and endpoints in one place
Tailored detections
shaped around your normal activity
Agreed playbook
signed off before anything happens
Log retention
sufficient for a forensic look back

Scope of the service

Some sources reveal far more than others. We start where most intrusions leave traces and widen the net step by step.

Check the scope with an engineer

Data sources

Your Microsoft or Google cloud tenant, perimeter devices and VPN; domain controllers; important servers; EDR. Website and shop logs can follow later.

What we look for

Logins from two continents within an hour, freshly created forwarding rules, unexpected promotions to admin groups, files being wiped or encrypted in bulk, VPN sessions at three in the morning.

Human review

Analysts sort false positives from benign quirks and genuine incidents. You hear from us in writing only about events that deserve your attention, while the background chatter stays with us.

Containment actions

Suspend a user, kill sessions, force a password change, quarantine a laptop, block an address. A written list states which of these we may do without phoning you first.

Major incidents

Support with containment, keeping evidence intact, cleaning up and getting back to normal. If personal data may be affected, we compile the facts counsel will need when deciding whether to notify.

Reports

Each month a jargon-free summary of what fired, what happened and what we suggest, followed by a brief quarterly call.

How the work runs

Expect a few weeks before the SOC knows your rhythms. By then a stream of raw alarms has turned into early warning you can trust.

01

Agreeing the brief

A brief runbook records sources, hours, contacts and actions we may take without asking.

02

Connecting

Log shipping is configured, we check nothing is missing and the first detections are activated.

03

Calibration

Between two and four weeks of learning what normal looks like for you, muting noise and agreeing justified exceptions.

04

Business as usual

Continuous watch, responses that follow the runbook, a monthly summary and quarterly tuning.

Break-ins rarely end in immediate damage. Criminals often linger for days or weeks, studying accounts and locating backups before they act. That quiet period is the defenders' best chance. A SOC exists less to bar the front door than to make sure nobody can roam your systems undetected.

Your questions answered

Analysts work Monday to Friday, 9:00-17:00 Central European Time. Overnight, automation carries on, isolating for instance any machine that starts behaving like ransomware. Staffed coverage at all hours is part of Premium or the 24/7 support service.

In EU-based data centres. Logs contain personal data, so they must appear in your record of processing and be covered by a data processing agreement with us. Retention is agreed with you, weighing operational needs against legal requirements.

Those rules expect essential and important entities to be able to detect, log and report incidents. SOC monitoring handles much of the technical side and gives you the material for a report to SI-CERT or the competent authority, but it does not make you compliant by itself.

EDR sees endpoints only. Hidden mailbox rules, cloud log-ins, VPN connections and firewall traffic are invisible to it, and the payment fraud described above needs no malware at all. A SOC is what ties those signals together.

Catch intrusions while they are still quiet

List your main platforms, firewall and endpoint product. We will recommend which data sources to connect first.

When we work
Weekdays 9:00-17:00 CET, answers the same or next working day
Calls
Video meetings, Teams and Meet both welcome

We set essential cookies only: the ones that keep the site running and recall which town you chose. Nothing for ads and nothing that follows you around the web. Details are in our privacy and data protection notice.