Who does what
Provider
- Operate detection tools and rules
- Investigate and manage incidents
- Execute agreed containment
Your team
- Provide access and permissions
- Make business decisions
- Arrange wider remediation
Coverage
- Endpoints
- Network
- Cloud Workloads
Details
Service scope
Best for Organisations outsourcing daily SOC work while retaining business oversight and wider recovery arrangements
Ongoing engineering is part of the offer
The outsourced model combines daily tool operation and rule development with investigation. Augmentation has a different work split.
Containment actions need a defined scope
File, process and account actions depend on connected controls and agreed permissions.
Breach support uses response partners
Forensics and extended breach support are extra partner services. Agree the recovery owner.
Full service analysis
Socura MDR runs the contracted detection tools, develops rules, investigates alerts and contains threats in its outsourced SOC model. You supply access and business context, set response permissions and arrange remediation and recovery beyond the service's containment work.
- Your team owns
- Provide access, business context and response permissions
- Maintain decision contacts and required tool licenses
- Arrange remediation and recovery beyond contracted containment
Ongoing engineering is part of the offer
Socura combines investigations with rule development, deployment, configuration and continuing tool tuning. The outsourced model supplies the daily SOC capability. The augmentation option instead supports an existing internal SOC. Agree the operating model in the service scope.
Containment actions need a defined scope
The service describes automated file quarantine, malicious-process termination and account suspension. The available actions depend on the connected controls and agreed authority. Confirm what can run automatically and what must wait for your approval.
Breach support uses response partners
Core incident handling includes containment and remediation guidance. Digital forensics and support for a business-impacting breach are additional partner services. Name the recovery owner and agree how the SOC, your IT team and the response partner will coordinate.
Pricing & contract
- Billing
- Per-user, Custom
The annual subscription depends on active IT users and monitored data sources. SIEM or EDR licenses can cost extra, as can partner breach support and optional exposure services. Get the selected tools, retention and response scope included in one quote.
Tradeoffs & buying questions
Strengths
-
Combines incident handling with ongoing detection engineering
-
Can use supplied controls or integrate an existing stack
Considerations
-
Partner forensics and breach support cost extra
-
Licenses and monitored sources affect the subscription
-
Response permissions need to be checked tool by tool
Ask before buying
- Which tools, log sources and detection rules will Socura operate throughout the contract, and which tasks stay with our IT team?
- Which file, process, account and endpoint actions can Socura execute without approval, and what happens if our decision maker cannot be reached?
- What costs and responsibilities apply to licenses, retention, breach forensics, recovery and exporting our incident history at exit?
Integrations
Platform / SIEM
- Google Security Operations
Endpoint
- Palo Alto Cortex XDR
Cloud
- AWS
- Microsoft Azure
- Google Cloud
Other integrations
- Palo Alto Cortex XSOAR
- Socura Incident Management Portal
Common questions
Does Socura MDR replace an internal SOC?
It can supply the daily detection and response operation in an outsourced engagement, which this profile covers. It also offers SOC augmentation. Neither arrangement transfers every IT remediation or business decision. Agree those responsibilities in the service scope.