Who does what
Provider
- SIEM health and tuning
- Detection upkeep
- Alert investigation
Your team
- Tenant and source systems
- Agreed response duties
- An available support contact
Details
Service scope
Best for Teams keeping ownership of their SIEM
Platform
Operates the customer-owned SIEM.
Workflow
Investigates alerts and escalates incidents to the assigned team.
Boundary
Customer source configuration and major upgrades need separate planning.
Full service analysis
Novacoast operates the buyer's SIEM, maintains detections and investigates alerts before escalation. The buyer keeps its tenant, source systems and incident-response responsibilities outside the agreed service scope.
- Your team owns
- Tenant and source systems
- Agreed response duties
- An available support contact
Pricing & contract
- Billing
- Custom
Scope the SIEM service separately from licenses, ingestion, retention and other managed tools. The standard service description treats major platform upgrades as separate projects.
Tradeoffs & buying questions
Strengths
-
The customer retains its SIEM tenant and detection investment.
Considerations
-
Source troubleshooting and access still require customer staff.
Ask before buying
- Which team executes containment after an escalation?
- Which upgrades and detection-engineering hours are included?
- Who handles broken log sources, and what after-hours access must we provide?
Integrations
Platform / SIEM
- Microsoft Sentinel
- Splunk
- Google Security Operations
3 more integrations
- Exabeam
- LogRhythm
- IBM QRadar
Common questions
Does co-management transfer ownership of the SIEM?
The offer retains the customer-owned environment. Document administrative access, export and handover rights in the agreement.