Data sources
Your Microsoft or Google cloud tenant, perimeter devices and VPN; domain controllers; important servers; EDR. Website and shop logs can follow later.
Taken separately, small oddities rarely look alarming. Put together, they can read like a crime report. Imagine an export business in Podravje. Early one Monday, someone logs in to the finance lead's mailbox from another country. Hours later an invisible inbox rule starts sending every “bank” message to an external mailbox. Two days on, an overseas customer is emailed fresh payment instructions. Three different systems, three separate logs, and not one alarm. A single analyst looking at all three together would have locked the account long before any payment was made. Joining those dots is what a Security Operations Centre does. Sign-in, mailbox, perimeter, server and endpoint data flow into one platform, detections shaped around how your business normally behaves run against it, and a human examines every hit. Once an incident is confirmed, we execute the playbook you signed off earlier, from suspending the user to revoking sessions and quarantining machines. Few SMEs could staff their own SOC, so ours runs entirely remotely.
Some sources reveal far more than others. We start where most intrusions leave traces and widen the net step by step.
Your Microsoft or Google cloud tenant, perimeter devices and VPN; domain controllers; important servers; EDR. Website and shop logs can follow later.
Logins from two continents within an hour, freshly created forwarding rules, unexpected promotions to admin groups, files being wiped or encrypted in bulk, VPN sessions at three in the morning.
Analysts sort false positives from benign quirks and genuine incidents. You hear from us in writing only about events that deserve your attention, while the background chatter stays with us.
Suspend a user, kill sessions, force a password change, quarantine a laptop, block an address. A written list states which of these we may do without phoning you first.
Support with containment, keeping evidence intact, cleaning up and getting back to normal. If personal data may be affected, we compile the facts counsel will need when deciding whether to notify.
Each month a jargon-free summary of what fired, what happened and what we suggest, followed by a brief quarterly call.
Expect a few weeks before the SOC knows your rhythms. By then a stream of raw alarms has turned into early warning you can trust.
A brief runbook records sources, hours, contacts and actions we may take without asking.
Log shipping is configured, we check nothing is missing and the first detections are activated.
Between two and four weeks of learning what normal looks like for you, muting noise and agreeing justified exceptions.
Continuous watch, responses that follow the runbook, a monthly summary and quarterly tuning.
Break-ins rarely end in immediate damage. Criminals often linger for days or weeks, studying accounts and locating backups before they act. That quiet period is the defenders' best chance. A SOC exists less to bar the front door than to make sure nobody can roam your systems undetected.
Analysts work Monday to Friday, 9:00-17:00 Central European Time. Overnight, automation carries on, isolating for instance any machine that starts behaving like ransomware. Staffed coverage at all hours is part of Premium or the 24/7 support service.
In EU-based data centres. Logs contain personal data, so they must appear in your record of processing and be covered by a data processing agreement with us. Retention is agreed with you, weighing operational needs against legal requirements.
Those rules expect essential and important entities to be able to detect, log and report incidents. SOC monitoring handles much of the technical side and gives you the material for a report to SI-CERT or the competent authority, but it does not make you compliant by itself.
EDR sees endpoints only. Hidden mailbox rules, cloud log-ins, VPN connections and firewall traffic are invisible to it, and the payment fraud described above needs no malware at all. A SOC is what ties those signals together.
List your main platforms, firewall and endpoint product. We will recommend which data sources to connect first.
Enquiry received
An engineer will write back no later than the following working day. Faults that leave your staff unable to work are always looked at first.
No town by that name here. Check the letters, or settle for the nearest larger place. Our engineers work only over the internet, so Kočevje and Koper get precisely the same treatment.