Executive Summary
Summarizes monitoring, detected attacks, defensive actions and any escalations for management.
Active Monitoring and Defense
We protect your network with timely actions
Security Operation Center (SOC)
The SOC continuously monitors server and client systems, network traffic and integrated third-party devices to detect anomalies and signs of attack.
Events are analyzed and classified to distinguish intrusion attempts from legitimate activity.
The SOC service involves a team of cybersecurity experts providing continuous monitoring of network traffic to detect anomalies and respond promptly to intrusion attempts.
With ISGroup's SOC service, you will be able to react and protect yourself from cyber attacks that could otherwise harm your company.
Description
During SOC or Security Operation Center operations, ISGroup's specialized team will monitor incoming and outgoing traffic from the monitored network infrastructure or data center.
Advanced anomaly detection techniques are used to identify suspicious behavior on the network.
In the event of an attack attempt, the ISGroup team will do its best to apply the procedures agreed with the client and limit the damage to the attacked infrastructure.
After a possible attack, security measures will be implemented to remedy the breach, and detailed reports of the incident will be provided to the client.
Specifications
The SOC service offered by ISGroup includes several phases divided into:
Monitoring
Passive
Advanced analysis systems will evaluate in real-time whether the traffic to the infrastructure is malicious. In case of potential problems, the security team is alerted by a warning.Active
The ISGroup SOC operators team, with the help of event analysis tools, classifies events, intrusion attempts, and possible breaches in the system.
Defense
Incident Management
The SOC team will implement the procedures agreed with the client and will limit the system's exposure to the ongoing attack as much as possible.Incident Response
Attacks are contained, and measures to repair the breach are applied immediately.
Escalation
When an event requires it, the case is escalated to ISGroup analysts, who investigate it further and step in to resolve the issue.
Reporting
Following an attack, a detailed report of the incident will be prepared, including an analysis of the attack and how the ISGroup team reacted to contain it.
The SOC report
Describes monitoring and, when an attack occurs, defensive actions, escalation and recommended measures.
Technical Details
Describes the attack, defensive actions and reasons behind each decision for the Security Manager.
Remediation Plan
Gives the System Administrator the measures needed to reduce the risk of similar attacks.
SOC
and compliance
NIS2
Monitors events, detects threats and supports containment and response, contributing to incident management and continuity under NIS2 Article 21(2)(b-c).
DORA
Detects anomalous activity, analyses events and supports ICT incident management under DORA Articles 10 and 17.
GDPR
Detects events on systems processing personal data and supports breach assessment and management under GDPR Articles 32-33.
PCI DSS
Monitors events and compromise indicators on payment systems, supporting logging and incident response under PCI DSS Requirements 10 and 12.10.
ISO/IEC 27001
Collects and analyses security events and supports response, contributing to ISO/IEC 27001:2022 controls A.8.15 and A.8.16.
NIST CSF
Performs threat monitoring, analysis and operational response, contributing to the Detect and Respond functions of the NIST Cybersecurity Framework 2.0.
Frequently asked questions about the
Security Operations Center (SOC)
What is the ISGroup Security Operations Center?
The ISGroup Security Operations Center (SOC) provides 24/7 monitoring, threat hunting, detection and response through a team of analysts. The team analyses the collected signals and acts on threats to protect the monitored environments.
Which sources and reports does the SOC service include?
The Security Operations Center analyses telemetry from endpoints, firewalls, networks and cloud environments. The service produces periodic reports on its activities and the security events it manages.
What happens when the SOC detects a threat?
The Security Operations Center analyses, contains and neutralises the threat. When the case requires further investigation, ISGroup manages the escalation to its analysts, who support resolution and also carry out fixing activities.
What is the difference between a SOC and a Vulnerability Management Service?
The Security Operations Center works with the security signals and events included in the scope, whereas the Vulnerability Management Service manages vulnerabilities, priorities and remediation support. The two services address different needs.
What is the difference between a SOC and Threat Intelligence?
The Security Operations Center uses the operational signals included in the scope to detect, assess and manage events, whereas Threat Intelligence and Digital Risk Protection provides information on threats and digital exposure.
How do I request a quote for the SOC service and what determines the cost?
The Security Operations Center is a subscription service. To prepare the quote, ISGroup collects the number of devices and users to protect and the required integrations; the proposal states the subscription period, included services and fee.
Shape your security priorities into a tailored proposal