Who does what
Provider
- Monitor and investigate SIEM events
- Improve detections and log use
- Support shared incident workflows
Your team
- Retain incident decisions
- Provide access and context
- Own assigned response work
Details
Service scope
Best for Security teams sharing investigation and detection engineering while retaining internal incident ownership
Engineering is part of the service
Use-case, rule, log and dashboard improvement accompanies monitoring. Agree engineering capacity and task ownership.
Shared cases need clear authority
Connect ticketing and escalation between teams and define who executes or approves each response action.
Specialist incident work has a boundary
Confirm when forensics, restoration or surge response need the separately offered incident-response service.
Full service analysis
Performanta's Managed SOC monitors your SIEM, investigates threats and improves use cases, detection rules, log management and response playbooks alongside your security team. You retain internal incident decisions, provide access and environment context and agree who executes containment, infrastructure fixes and recovery.
- Your team owns
- Retain internal incident decisions and operational contacts
- Provide access, context and required environment changes
- Arrange the agreed containment and recovery work split
Engineering is part of the service
The SOC offer includes ongoing work on SIEM use cases, rules, logs and dashboards, alongside event analysis and threat hunting. Agree the included engineering capacity and the division of platform work with your internal team.
Shared cases need clear authority
Performanta describes a hybrid operating approach with connected ticketing, reporting and internal customer capability. Define who owns each response step, which actions need approval and how incidents move between the two teams.
Specialist incident work has a boundary
Performanta also offers a separate incident-response consulting service that can support or lead a wider response. Confirm how that service connects to routine SOC handling and whether forensics, restoration or surge capacity carry additional terms.
Pricing & contract
- Billing
- Custom
Request a quote for the chosen SIEM, data sources, engineering scope and response responsibilities. Separate SIEM consumption, tooling, onboarding and specialist incident response from the recurring SOC fee.
Tradeoffs & buying questions
Strengths
-
Includes ongoing SIEM engineering rather than alert review alone
-
Supports shared workflows with an internal SOC
Considerations
-
Customer incident ownership and participation remain
-
Exact containment authority requires agreement
-
Specialist response and recovery need separate scoping
Ask before buying
- Which SIEM administration, use-case, rule and log-source tasks are included, and how are improvements prioritised with our team?
- Which response actions will Performanta execute directly, and when do containment, forensics or recovery require a separate engagement?
- Can you demonstrate our non-Microsoft integrations and provide a sample investigation ticket, escalation record and total service quote?
Integrations
Platform / SIEM
- Microsoft Sentinel
- IBM QRadar
Other integrations
- Encore ASM
Common questions
Is Safe XDR automatically included?
Performanta sells Safe XDR and other managed security services alongside its SOC offer. Ask which platform capabilities, automation, exposure management and licenses are included in your particular engagement.