Who does what
Provider
- SIEM maintenance and tuning
- 24/7 alert investigation
- Incident handoff
Your team
- Data interfaces and collectors
- Incident handling
- Required replies and approvals
Details
Service scope
Best for Germany-based SOC with retained incident owners
Platform
Provider-operated IBM QRadar and collectors with customer dashboard visibility.
People
SOC analysts and support based in Germany.
Boundary
Incident remediation and source-system management depend on additional contracted scope.
Full service analysis
plusserver SOC as a Service operates QRadar, maintains detection rules and investigates alerts before handing incidents into the customer's response process. The buyer maintains agreed data interfaces and handles incidents unless further response work is covered by a booked management level.
- Your team owns
- Data-interface maintenance, required collectors and logging changes.
- The incident process, timely replies and response beyond the booked management level.
Pricing & contract
- Billing
- Custom
Standard onboarding starts at €7,800 before applicable taxes, according to the provider. The recurring service needs a quote. Confirm EPS limits, retention beyond 1 month, custom detections and response-management charges.
Tradeoffs & buying questions
Strengths
-
The service terms define the SIEM duties and the customer handoff.
Considerations
-
Base service excludes individual incident remediation and direct SIEM-console access.
Ask before buying
- Which incident actions are included in our management level, and which require a separate request or fee?
- What EPS allowance, retention period and custom detection work are included beyond standard onboarding?
- How do we export our evidence and detection configuration when the service ends, given the lack of direct console access?
Integrations
Platform / SIEM
- IBM QRadar
Common questions
Does the base service contain incidents for us?
The service description provides investigation and notification. Further actions depend on agreed runbooks and the management level booked for the affected systems.