Who does what
Provider
- Monitor and investigate events
- Hunt threats
- Perform agreed incident response
Your team
- Set scope and permissions
- Make business decisions
- Own out-of-scope recovery
Details
Service scope
Best for Enterprises seeking a SOC service across existing systems with an agreed response and platform-management scope
Core and advanced scope
Core monitoring and incident handling are distinct from advanced identity, cloud and WAF services.
SIEM management needs scoping
Include SIEM takeover, tuning and feed repair explicitly if you want to transfer those duties.
Agree execution authority
Define permitted response actions, approval paths and major-incident or recovery allowances.
Full service analysis
Systal SOC as a Service monitors security events around the clock, investigates threats and provides containment and remediation within the agreed scope. You retain business decisions, response permissions and responsibility for systems or recovery work outside that agreement.
- Your team owns
- Set scope and response permissions
- Approve business-impacting decisions
- Own systems and recovery outside the agreement
Core and advanced scope
The core service combines monitoring, hunting, response workflows and incident handling. Identity, cloud and WAF monitoring appear separately as advanced services. Specify which sources and operating tasks are included in your order.
SIEM management needs scoping
Systal offers takeover and support of an existing SIEM alongside its SOC service. Include platform administration, detection changes and failed-feed repair explicitly if those are responsibilities you want to transfer.
Agree execution authority
The SOC service includes containment and remediation, but each connected system needs an agreed action and approval path. Separate routine response from major incident work, business recovery and any additional specialist allowance.
Pricing & contract
- Billing
- Custom
The quote should distinguish core monitoring and incident handling from advanced monitoring, SIEM takeover and any additional response allowance. Identify platform licenses, data volumes, retention and the agreed recovery scope.
Tradeoffs & buying questions
Strengths
-
Can connect existing security environments
-
Combines monitoring with incident handling
Considerations
-
Advanced monitoring requires scope checks
-
SIEM takeover is a separate scoping decision
-
Response permissions and recovery duties need agreement
Ask before buying
- Which containment and remediation actions will Systal execute, and which require our approval?
- Does the order include daily SIEM administration, detection tuning and feed repair, or are those separate services?
- What licenses, data allowance, retention and incident-response hours does the recurring fee include?
Common questions
Does SOC as a Service automatically replace our SIEM team?
Specify that operating scope in the order. Systal also offers SIEM takeover and support, but its SOC service page does not assign every platform task to the standard service.