SOC Providers.com Security Operations Center providers
Last reviewed: 3 Oct 2026

Sopra Steria SOC Core

Sopra Steria SOC Core monitors agreed logs, investigates alerts and maintains detection rules with the customer's team. The buyer supplies asset context and an incident process, then carries out containment and recovery unless the selected response tier assigns those actions to the SOC.

Platform
Their platform

Who does what

Provider

  • 24/7 log analysis
  • Detection-rule maintenance
  • Incident evidence and guidance

Your team

  • Asset and business context
  • Incident process
  • Remaining response tasks

Coverage

  • Network
  • Cloud Workloads

Details

Service scope

Best for UK teams sharing SIEM and incident work

  • Offer

    UK SOC Core, with two response tiers to agree during scoping.

  • Workflow

    Rules generate alerts, analysts verify incidents and evidence enters the customer's incident process.

  • Boundary

    Log-capture infrastructure is separate and the response clock ends at ticket creation or escalation.

Full service analysis

Sopra Steria SOC Core monitors agreed logs, investigates alerts and maintains detection rules with the customer's team. The buyer supplies asset context and an incident process, then carries out containment and recovery unless the selected response tier assigns those actions to the SOC.

Your team owns
  • Asset context, business use cases and the incident management process.
  • Containment and recovery tasks not assigned in the selected response tier.

Pricing & contract
Billing
Custom

The May 2024 G-Cloud 14 pricing document lists £9,200/month for 0–25 GB of daily log ingestion. Log-capture tooling and infrastructure are excluded. Confirm current rates, taxes, onboarding and response-tier scope. The listing's separate daily rate is not the monthly SOC price.

Tradeoffs & buying questions

Strengths

  • SIEM maintenance and playbooks are part of the ongoing service.

Considerations

  • The published response clock ends at ticket creation or escalation, so it does not establish time to containment.

Ask before buying

  • What changes between the two response tiers, and which containment actions will your analysts execute?
  • Does the response SLA stop at ticket creation or include action on the affected system?
  • What is the current monthly price for our daily log volume, including capture tools, retention, onboarding and taxes?

Integrations

Platform / SIEM

  • Microsoft Sentinel
  • Splunk

Common questions
Does the core service take over incident response?The core workflow provides investigation, escalation and guidance. Confirm the selected response tier's action permissions before assigning containment to the SOC.

The core workflow provides investigation, escalation and guidance. Confirm the selected response tier's action permissions before assigning containment to the SOC.

Company details
SOC regions
Europe / UK