Skip links

SOC as a Service / MDR 24/7 and Threat Hunting & Threat Intelligence

Continuous monitoring, threat investigation and proactive search for signs of compromise, with defined responsibilities and results for your organization

Navighează la

Safetech Innovations services support organizations that need threat monitoring and response or want to complement the capabilities of their internal security team. The STI CERT center brings together operational expertise and relevant information to investigate alerts and understand risks.

You can select 24/7 Managed SOC/MDR monitoring, recurring Threat Hunting & Threat Intelligence service, or a combination defined according to your organization's needs. Each service has its own activities, deliverables, and liability limits.

Utility and benefits

Through these services, your organization can benefit from:

Threat visibility

Analyze security intelligence from included sources and systems

Operational continuity of monitoring

24/7 coverage through the Managed SOC / MDR service

Access to specialized expertise

Teams that investigate alerts and analyze threats in the context of infrastructure

Proactive identification

Looking for signs of advanced threats through Threat Hunting activities

Information for decisions

Reports and recommendations that support the prioritization of security measures

Process improvement

Lessons learned and findings that can guide the adjustment of existing capabilities

Service Methodology and Characteristics

The 24/7 Managed SOC / MDR, Threat Hunting, and Threat Intelligence services have the following characteristics:

Managed SOC (SOCaaS) / MDR 24/7

We provide security monitoring 24 hours a day, seven days a week, with the detection, investigation and escalation of threats from the agreed perimeter. The service involves L1/L2 teams and access to L3 expertise for complex incidents.

We analyze the alerts in the context of integrated systems and sources, evaluate the findings and communicate the necessary information to the responsible teams. The response actions are carried out within the limits of the responsibilities, authorizations and technical possibilities established for the service. The way of collaboration with the beneficiary team and the escalation criteria are defined before the operation.

Deliverables:

  • 24/7 monitoring
  • Alerts investigated and escalated
  • Detailed monthly report
  • Lessons learned quarterly
  • Service levels and response commitments defined by the contractual SLA.

Collaboration model: recurring service, with a minimum six-month subscription. Services, technologies, response times and escalation criteria are contractually agreed, together with the limits of responsibility for the intervention.

Threat Hunting & Threat Intelligence

We proactively look for signs of threats that require in-depth analysis, including advanced persistent threats (APTs), insider threats, and lateral movement in infrastructure. Threat hunting activities are tailored to the objectives and information available in the analyzed perimeter.

The Threat Intelligence component brings information about threats relevant to the organization, including compromise indicators and dark web monitoring in the agreed coverage. We correlate findings with the context of the beneficiary and communicate information that can guide investigations and protection measures.

Deliverables:

  • Monthly Threat Hunting Report
  • Indicators of compromise — IOC — and tactics, techniques and procedures — TTP — identified
  • Monthly Threat Intelligence Report
  • Proactive alerts on relevant findings from dark web monitoring.

Collaboration model: recurring service, with monthly or quarterly activities and monthly reports. Sources, coverage, frequency of activities, duration of data retention and access limits are contractually defined. The volume of activities and the criteria for accepting deliverables are established for collaboration. Managed SOC / MDR 24/7 monitoring is selected separately.

Collaboration mode and service parameters

Collaboration mode

The offer is built around the perimeter and the desired results. We define together the relevant parameters:

ServiceDelivery modelParameters set for collaboration
Managed SOC / MDR 24/7Recurring; minimum six monthsIntegrated systems and sources, technologies, SLAs, escalation, action authorization, and response responsibilities.
Threat Hunting & Threat IntelligenceRecurrent; monthly or quarterly activitiesHunting objectives, sources, coverage, frequencies, data access, data retention and volume of activities.

 

Technologies that support the services

Depending on the beneficiary architecture, the SOC service can use Stellar Cyber for XDR/NDR, Splunk or Microsoft Sentinel for event analysis, Darktrace for NDR, and Cynet for EDR. ThreatEcho can support threat and risk intelligence analysis.

For Threat Hunting & Threat Intelligence, the tools available include ThreatEcho, Kela and MISP. The selection of sources and platforms takes into account the objectives of the service, the available access and the terms of use. The technologies and licenses included are stated in the offer; the tools are selected for each collaboration.

Initiating and conducting the collaboration

  1. Defining objectives. We clarify the needs of the organization, the selected services, the infrastructure and the responsibilities of the teams.
  2. Preparation of access and integrations. We agree on the sources of information and the technical conditions necessary for the contracted activities, together with the rules of access and communication.
  3. Establishing operational procedures. We define escalation, contact persons and authorized response actions.
  4. Provision of services. We monitor and investigate alerts or carry out hunting and intelligence activities, according to selected services.
  5. Reporting and reviewing results. We present findings and priorities, following the reporting timeline and agreed targets.

Complementary services

For managing the necessary technology, you can select solution integration and management services separately. Recurrent vulnerability management, security testing, SOC function auditing, and GRC consulting have distinct objectives and are included when explicitly contracted.

For the availability of an intervention team or the analysis of a managed incident, you can consult the incident response and post-incident analysis services.

What recommends us?

STI CERT has been providing SOC services since 2015, with 24/7/365 coverage, and is accredited by Trusted Introducer. The center’s expertise supports alert investigation and threat analysis in the context of the beneficiary’s infrastructure, with escalation and response responsibilities defined for each collaboration.

The adaptation to the customer’s environment is also supported by public testimonials: Smartree HrTech highlights the operational maturity of the SOC team and Safetech’s ability to adapt the solution to the specifics of its activity.

Contact us

Similar articles

See all articles
Powered by  GDPR Cookie Compliance (opens in a new tab)
Overview of Privacy

This website uses cookies to provide you with the best user experience. Cookie information is stored in your browser and serves the purpose of recognizing you when you return to our site, as well as assisting our team in understanding which sections of the site you find more interesting and useful. For more information, you can refer to the General Information Note Regarding the processing of personal data.