Who does what
Provider
- Analyze network evidence
- Investigate and hunt threats
- Escalate findings and guidance
Your team
- Maintain traffic and log feeds
- Implement infrastructure changes
- Own remediation and recovery
Coverage
- Network
Details
Service scope
Best for MSPs seeking network visibility and investigation support
Investigation and handoff
Analysts investigate network evidence and recommend response. Specify execution rights and the MSP handoff in the contract.
Companion services
Endpoint, cloud, incident-response and co-management services need their own scope.
Data visibility
Coverage depends on sensor placement and log sources. Confirm retention, off-site storage and access in the order.
Full service analysis
SOCSoter's Managed Network SIEM collects network telemetry, investigates suspicious activity and escalates findings with recommended response steps. Your MSP keeps traffic and log feeds connected, implements remediation and arranges any separately scoped incident-response or tool-management work.
- Your team owns
- Provide network visibility and maintain source logging
- Act on escalations and apply infrastructure changes
- Arrange incident recovery and separately scoped services
Scope the network service separately
The network service gives analysts traffic, asset and log evidence to investigate. SOCSoter lists endpoint protection, cloud monitoring and professional incident response separately. Specify the services and permitted actions in the order.
Visibility depends on deployment
The appliance supports packet inspection, protocol analysis, syslog collection and passive asset discovery. Map the network paths and sources it will receive before relying on its coverage, particularly for remote users and disconnected segments.
Test the escalation handoff
The portal supports client views, tickets and analyst communication. Ask for an example investigated incident and test the path from escalation to MSP action. Agree after-hours contacts and restoration responsibilities before onboarding finishes.
Pricing & contract
- Billing
- Custom
Request a quote for the monitored sites, data sources, retention and required companion services.
Tradeoffs & buying questions
Strengths
-
Adds network evidence beyond endpoint-only monitoring
-
Provides direct analyst communication through the portal
-
Supports client-specific reporting and escalations
Considerations
-
Network coverage depends on delivered traffic and logs
-
Broader IR and tool management need separate scoping
-
Published retention wording needs contract confirmation
Ask before buying
- Which sites and network segments will the sensor actually see, and who restores broken packet or log feeds?
- Which response steps will SOCSoter execute under this order, which require MSP action and how are urgent contacts tested?
- What do the quote and retention terms include, and what changes when we add endpoint, cloud, incident-response or co-management services?
Integrations
Other integrations
- ConnectWise
- Autotask
Common questions
Does the network SIEM include endpoint and cloud response?
Those are separate SOCSoter service lines. Define any combined package and response authority in the order rather than assuming the network service includes them.
Does SOCSoter take over all incident recovery?
The network service describes investigation and response recommendations. SOCSoter also offers professional incident-response services, whose scope should be agreed separately.