Who does what
Provider
- Monitoring and investigation
- Detection and playbook upkeep
- Agreed response steps
Your team
- Selected containment actions
- Estate changes and decisions
Details
Service scope
Best for Teams sharing SOC work across existing security tools
Model
The co-managed option with responsibilities agreed during onboarding.
Operation
Continuous investigation, detection tuning and service reviews.
Response
Runbooks define delegated actions and escalation to customer teams.
Full service analysis
FourNet's co-managed SOC investigates alerts, maintains detections and carries out response steps agreed in runbooks. The buyer retains selected containment actions, estate changes and incident decisions assigned to its own team.
- Your team owns
- Selected containment actions
- Estate changes and decisions
Pricing & contract
- Billing
- Custom
Request a scope-specific quote for tools, telemetry, onboarding and response. Have the quote define the monitored estate and included response work rather than an unspecified instance.
Tradeoffs & buying questions
Strengths
-
The service makes action ownership part of onboarding and recurring review.
Considerations
-
The selected operating split determines which response tasks stay in-house.
Ask before buying
- Which actions does FourNet execute without asking, and which stay with us?
- What sources, tools and analyst work are included in the monthly fee?
- Who owns incident recovery and changes to production infrastructure?
Common questions
Can FourNet take full operational ownership?
FourNet offers both shared and full operating models. This profile covers the co-managed option, so agree a different responsibility split if buying full operation.