Who does what
Provider
- Operate Sentinel and detections
- Investigate and manage cases
- Execute agreed response actions
Your team
- Provide licenses and permissions
- Make business decisions
- Own wider IT remediation
Coverage
- Endpoints
- Network
- Cloud Workloads
Details
Service scope
Best for Organisations outsourcing daily SOC operation while keeping business oversight and wider IT remediation arrangements
Daily operation includes the platform
Littlefish maintains Sentinel, collectors and detections, investigates alerts and manages confirmed incidents.
The response plan is agreed in advance
The Critical Hour Framework sets authorised actions and priorities. It is not a one-hour containment guarantee.
Recovery needs a separate work split
Confirm responsibility for patching, firewall changes and rebuilds, which the core CSOC schedule excludes.
Full service analysis
Littlefish's fully managed SOC operates Sentinel, maintains detections and log collection, investigates threats and runs incident handling under the agreed Critical Hour Framework. You provide licenses and response permissions, make business decisions and retain patching, firewall changes and asset rebuilding unless separately contracted.
- Your team owns
- Provide licenses, data budgets and response permissions
- Define business priorities and decision contacts
- Arrange patching, firewall changes and rebuilding outside scope
Daily operation includes the platform
Littlefish manages Sentinel, log collectors, ingestion limits, detection rules and automated playbooks. Analysts investigate alerts, tune false positives and manage confirmed incidents through the service's case process.
The response plan is agreed in advance
The Critical Hour Framework defines priorities, technical actions and decision contacts during onboarding. It structures early incident handling. Its name is not a promise that every incident will be contained or resolved within an hour.
Recovery needs a separate work split
The service page describes response through recovery, while the procurement schedule excludes routine patching, firewall changes and asset rebuilding from the core CSOC scope. Confirm the teams and charges for those tasks before signing.
Pricing & contract
- Billing
- Per-user, Custom
Price the selected SOC components, user count and contract term together. Add onboarding, Microsoft licenses, ingestion and retention, plus any dedicated incident-response or infrastructure-remediation work. Older procurement user bands cover specific MDR/XDR packages, not every current SOC engagement.
Tradeoffs & buying questions
Strengths
-
Combines platform upkeep with incident handling
-
Defines permissions and incident priorities during onboarding
Considerations
-
Microsoft consumption and licenses need separate budgeting
-
Core SOC scope does not include every remediation task
-
Extra Defender components and dedicated response need scoping
Ask before buying
- Which daily SIEM, detection and incident tasks are included in the fully managed model, and which service components cost extra?
- Which Critical Hour actions are pre-authorised, who can approve disruptive changes and what happens if our decision maker is unavailable?
- Who owns eradication and recovery tasks, and what fees apply to ingestion, retention, dedicated response and infrastructure changes?
Integrations
Platform / SIEM
- Microsoft Sentinel
Cloud
- Microsoft Azure
Other integrations
- Azure Lighthouse
- Littlefish ITSM
Common questions
Does Littlefish also offer a co-managed SOC?
Yes. The current offer supports fully managed and co-managed delivery. This profile covers the fully managed model. A shared engagement should specify which analyst, platform and response tasks stay with your team.