Who does what
Provider
- Operate and tune Sentinel
- Investigate and hunt threats
- Maintain scoped SOC components
Your team
- Join incident escalation
- Set response permissions
- Own out-of-scope recovery
Coverage
- Endpoints
- Network
- Cloud Workloads
Details
Service scope
Best for Teams sharing security operations while outsourcing Sentinel maintenance and round-the-clock investigation
Daily work includes SIEM upkeep
SIEM and supporting-agent maintenance, tuning and post-incident improvements sit alongside monitoring.
Incident work is collaborative
Escalation and investigation are shared. Agree permissions for disruptive actions and the recovery handoff.
Choose the scope within the portfolio
Select detection and containment coverage explicitly. Wider IT services and other regional SOCs have separate scopes.
Full service analysis
Advania UK's Cyber Security Operations Centre service operates Sentinel monitoring, investigates threats and maintains the SIEM and supporting agents within scope. Your team participates in incident escalation and investigation, sets response permissions and retains the infrastructure and recovery work outside the agreed service.
- Your team owns
- Participate in incident escalation and investigation
- Approve response permissions and business decisions
- Arrange infrastructure work and recovery beyond scope
Daily work includes SIEM upkeep
The operating scope includes SIEM and supporting-agent maintenance, tuning, monitored-asset management and improvements after incidents. That adds recurring platform work to the monitoring and investigation service.
Incident work is collaborative
The service definition describes collaborative escalation and investigation. Current service material includes containment and hunting, but the permissions for disruptive actions and the ownership of recovery need to be recorded in your agreement.
Choose the scope within the portfolio
Advania can deliver a narrower detection service or a broader containment engagement. Managed devices, identity, infrastructure support and other regional Advania SOC offers should be scoped separately from this UK Sentinel service.
Pricing & contract
- Billing
- Custom
Scope the recurring CSOC fee separately from Microsoft licensing and consumption, onboarding and wider managed IT services. The public procurement attachment is a consultancy day-rate card, not a complete SOC subscription price.
Tradeoffs & buying questions
Strengths
-
Includes recurring SIEM maintenance and tuning
-
Supports existing security operations with collaborative incident work
Considerations
-
Response permissions require a contract-specific matrix
-
Detection-only scopes provide less response ownership
-
Wider IT administration and recovery need separate agreement
Ask before buying
- Which SIEM, agent and detection-maintenance tasks are included, and who owns the tenant and content when we leave?
- Which containment actions can Advania execute without approval, and who leads escalation, eradication and recovery?
- What does the total price include for licensing, ingestion, retention, onboarding and wider managed IT support?
Integrations
Platform / SIEM
- Microsoft Sentinel
Cloud
- Microsoft Azure
Common questions
Does Sentinel limit coverage to Microsoft products?
No. The current service can ingest telemetry from other critical assets. Confirm each source, detection use case and response integration, because log ingestion alone does not establish active containment capability.