Security operations centre
Extend your security operations team.
Choose which parts of detection, investigation and response Vambrace should run, and where your own team stays involved.
Discuss SOC coverageWhich managed service fits your team?
Who does what in a managed SOC?
Agree the systems, hours of cover and decisions the service will support before monitoring starts.
Service responsibilities
- Your IT team
- Names the priority systems, supplies access and identifies people who can authorise a change.
- Vambrace analysts
- Check the agreed signals, investigate suspicious activity and explain what the evidence supports.
- Together
- Agree cover hours, escalation contacts and which actions the SOC can take without calling first.
SOC customer film
Inside the Vambrace SOC
Follow an overnight alert from the first sign-in to the analyst’s decision. Hear from a customer about working with the team.
In Sumo Logic’s Insight Radar, detection rules turn records into signals. Related signals can form an insight for an analyst to investigate.
Read the transcript
Two in the morning. An unfamiliar device signs in. A minute later, the same account downloads a sensitive file. Our managed detection and response service uses Sumo Logic to bring activity from your accounts, devices and cloud services into one place.
This is Sumo Logic’s Insight Radar. The blue ring around the outside shows Records. The bars just inside it show Signals. A Signal fires when activity matches a detection rule. The triangles nearer the centre mark Insights. If distinct Signals for the same account push its activity score above the threshold, Sumo Logic groups them into an Insight. Our analyst opens it to see which Signals fired, and in what order.
With Enterprise MDR, our analysts are on duty around the clock. If the evidence points to a compromised account, we call the people you’ve named and help your team contain the threat. As a Sumo Logic Managed Security Services Partner, we connect your data sources, tune the detection rules to your business, and build response plans with the people who’ll use them.
Here’s how one Vambrace client describes the support. The team are very friendly, knowledgeable and trustworthy. It helps us just to know that we’ve got somebody there that has our back, and we always know that we can trust them to ensure that everything is secure.
Talk to the Vambrace team about managed detection and response.
Play film 1:30What to agree before monitoring starts
Start with a service your organisation relies on. Which accounts and devices are involved? Where are the logs kept? Who is available if activity needs investigation outside working hours?
We use those answers to agree which sources to connect, the hours analysts will cover and the decisions your team keeps. The operating model can extend an existing security team or supply functions you do not run in-house.
Which managed service fits the work?
Managed detection and response brings analysts into investigations across accounts, devices and cloud services.
Endpoint detection and response focuses on activity on a device and the authority to isolate it.
Managed cloud SIEM connects log sources and tunes detections so analysts can follow an event across systems.
How a managed SOC supports your team
Choose the monitoring hours your team needs
The biggest obstacle to building an in-house SOC is achieving continuous coverage.
Gaps for training, holidays, and illness all need to be covered, and that is before you even start with the time hungry business of recruitment, people management, and be able to successfully retain these individuals.
For out-of-hours coverage, compare the cost of staffing a shift with the service scope you need. Price logging separately from investigation: source volumes, retention, searches and response responsibilities affect the estimate.
Start a conversationHow the SOC investigates an alert
A sign-in from an unfamiliar device might be a member of staff travelling, or someone using a stolen account.
Using Sumo Logic Cloud SIEM, our analysts compare the sign-in with the evidence available from connected systems. A privilege change or an unusual download can change the assessment.
If action is needed, the analyst explains the evidence, the affected account and the decision for your team. Escalation and containment follow your agreed response plan.
Start a conversationAgree which cloud activity the SOC can see
Choose the sign-in, application and administrative events that matter to your business. Some services expose detailed audit logs only with particular licences. We check coverage and retention with your team before relying on a source.
For example, if an administrator creates a new privileged account, decide which log records it, who reviews the alert and who can remove the access. Test the escalation route together.
Managed cybersecurity services FAQs
What are managed cybersecurity services?
Vambrace’s Security Operations Centre takes on the security work you agree with us, from investigating suspicious activity to checking whether fixes have closed a vulnerability. We agree the systems covered, the hours of service and who can authorise a response.
How does a Managed SOC work?
We connect the agreed data sources, tune the detections and give analysts the context to investigate. Monitoring hours and the authority to take action depend on your service tier and response plan.
Who needs a Managed SOC?
Any organisation that stores, processes, or relies on data can benefit from a Managed SOC. It is especially valuable for small and mid-sized businesses that may lack the resources to run a dedicated in-house SOC, as well as enterprises looking to strengthen their cybersecurity posture and meet regulatory compliance.
Does a Managed SOC help with compliance?
Security records and investigation histories can help a control owner show how monitoring operates. The evidence required depends on the scope of the assessment and the applicable controls.
Does a Managed SOC take over all aspects of cybersecurity?
We agree the operational tasks you want the SOC to run. Your organisation keeps responsibility for business decisions, system changes and other controls such as backups or policy ownership unless agreed otherwise.