C · 01 / Managed SOC · 24/7

A quiet SOC
is a working
SOC.

Q: Do I need a managed SOC if I already run EDR?

EDR is a sensor, not a response. CrowdStrike, SentinelOne, and Defender for Endpoint generate hundreds of alerts a week on a mid-sized fleet; without analysts to triage, the bulk sit in a console nobody is reading on a Tuesday at 2 AM. A managed SOC consumes those EDR alerts alongside firewall, identity, email, and cloud telemetry, correlates them into actual incidents, suppresses the false-positive chaff, and calls a human at 2 AM when a ransomware staging pattern actually shows up. If you already own EDR, you're most of the way to SOC Core — we just add the analysts and the 24/7 eyes.

Q: What is the difference between MDR and MSSP?

An MSSP (Managed Security Services Provider) is the older model — they typically forward you tickets from a SIEM, manage your firewall rules, and hand you 200-page reports nobody reads. MDR (Managed Detection and Response) is outcome-focused: analysts own the detection, triage, and containment loop on your behalf, and are measured on MTTD and MTTR rather than ticket volume. We operate as an MDR provider with MSSP-style transparency — you get the containment authority and detection outcomes of MDR, plus full access to every log, every query, and every custom detection we build for your environment. No black-box dashboards, no 'call us for the raw data' nonsense.

Q: How do you handle false positives?

False positives are the core failure mode of bad SIEM operations — analysts get fatigued, real alerts get missed, clients lose trust in the console. We run a named false-positive tuning cycle on every new client for the first 90 days: every triaged alert is tagged with a disposition, recurring FPs get a suppression rule written into the SIEM with a justification comment, and every suppression gets re-reviewed every 90 days so stale suppressions don't hide real signal. Typical client goes from 300+ alerts/week in week one to under 40 actionable alerts/week by day 90. We publish the FP rate as a monthly line item — if it's creeping above 15%, that's a tuning review trigger, not a 'we'll get to it'.

Q: Do you replace my IT team?

No. We complement them. Your IT team owns endpoint deployment, patching, identity provisioning, and the day-to-day operations of the systems we monitor. We own the detection, triage, and escalation loop on top of their work. When we catch something — say, a suspicious service account login from Lagos at 3 AM — we investigate, contain if authorized, and hand the remediation work to your IT team with full context: what happened, what we did, what they need to do. Your IT team stops being the midnight escalation for every Defender alert that could be anything; we are.

Q: What is your P1 alert response time?

P1 is defined as confirmed active compromise, ransomware staging, data exfiltration in progress, or privileged account takeover. On SOC Core the SLA is 10 minutes from alert fire to analyst engagement, with containment authorized within 30 minutes. On SOC Advanced it tightens to 5 and 15 minutes. In practice our 2025 YTD metro median for P1 engagement is 3 minutes 42 seconds — faster than the SLA because P1 alerts page the named on-call analyst directly, not the shared queue. If a P1 breaches SLA on your account, the monthly invoice automatically credits a percentage of base fee; you don't file a ticket, the system credits itself.

Q: Can you integrate with my existing SIEM?

Yes. We deploy into whatever you already have, or we rebuild on our preferred stack — your call. We have named-analyst-certified depth in LogRhythm, Splunk (Cloud & Enterprise), Microsoft Sentinel, and Wazuh (our open-source option for cost-sensitive clients and smaller fleets). We also operate Elastic Security, Chronicle, and Exabeam environments on a co-management basis. If you're already licensed on Splunk and happy with it, we don't ask you to rip-and-replace — we just stand up our analyst team on top of your existing instance and write the detections you're missing.

Q: Do you support bring-your-own cloud SIEM?

Yes. BYO cloud SIEM is actually our most common pattern for M365-centric clients — you already pay for Microsoft Sentinel on your E5 license, so we simply build out the connectors, ingest rules, workbooks, and detection content in your Azure tenant and operate it under co-management. Your data stays in your tenant, your license stays in your Microsoft agreement, and we bring the analyst hours and the detection engineering. Same pattern works for Splunk Cloud, Elastic Cloud, Chronicle, and Sumo Logic. No data egress to a vendor cloud, no second SIEM bill.

Q: What does 'tied to physical dispatch' mean for a cyber SOC?

Most cyber incidents have a physical component — a badge that shouldn't have worked, a rogue access-point plugged in overnight, a server room door propped open, a disgruntled ex-employee tailgating into a field office. When our SOC analysts see a badge anomaly or an unauthorized device on the network, we can dispatch a licensed officer from the Memphis center to walk the site, verify what's happening, pull the device, and secure the scene — often within the same hour. Pure-cyber SOCs can't do that; they file a ticket and hope your facilities team handles it by morning. Our 24/7 physical dispatch is already live for the alarm-response side of the business, so tying the cyber SOC into it was a natural step.

Q: How long do you retain logs and what about compliance archive?

Standard retention is 12 months hot (queryable, indexed, available for real-time hunting and incident investigation) plus 7 years cold archive (compressed, integrity-hashed, retrievable within 72 hours for audit or legal hold). The hot tier lets us hunt historically across an entire year of logs without a restore request; the cold tier meets the long-tail retention clauses in HIPAA, PCI-DSS, CMMC Level 2, FINRA, SOX, and most state-level breach-notification statutes. For CMMC-regulated clients we additionally write logs to a FedRAMP-Moderate archive in a separate tenant, with chain-of-custody documentation maintained for every retrieval.

Q: What platforms and vendors do you support for EDR?

We are vendor-agnostic on EDR by policy — no kickbacks, no 'preferred partner' quotas, no lock-in. Our named-analyst depth is strongest on CrowdStrike Falcon, SentinelOne Singularity, and Microsoft Defender for Endpoint (including the Defender for Business SKU for sub-300-endpoint clients). We also fully support Sophos Intercept X, Carbon Black, Cortex XDR, and Huntress (which we recommend for managed-IT partners who want us to layer detection on top). If you already own a license, we deploy into it. If you're greenfield, we recommend based on your fleet size, OS mix, and budget — and we'll quote you the license through us at cost or point you at a direct-to-vendor buy, your call.

Most managed security feels loud because the console is noisy, not because you’re being attacked. Our Memphis SOC runs human-staffed around the clock, tunes your SIEM until the noise drops 80 percent in the first ninety days, and escalates with a phone call — not a ticket — when something actually matters. Vendor-agnostic EDR, BYO-SIEM welcome, tied to our 24/7 physical dispatch for incidents that leave the network and end up at a door.

Request SOC Assessment Call SOC Dispatch · (202) 222-2225

DisciplineManaged SOC / MDR

CodeC · 01

Coverage24 / 7 / 365

MTTD (P1)< 5 min Advanced

MTTR (P1)< 15 min Advanced

SIEM stackLogRhythm · Splunk · Sentinel · Wazuh

EDRCrowdStrike · SentinelOne · Defender

Retention12 mo hot · 7 yr archive

ComplianceHIPAA · PCI · CMMC

3 min 42 s

P1 MTTD · YTD median

Alert-to-analyst engagement · 2025 rolling · SOC Core & Advanced

11 min 18 s

P1 MTTR · YTD median

Engagement to first containment action · pre-authorized runbook

87%

FP rate reduction

Week 1 baseline vs. day 90 · named tuning cycle · per-client

1 : 8

Analyst-to-client ratio

Advanced tier · dedicated named lead · not a shared queue

A quiet SOC
is a working SOC.

— SOC operations principle · internal · adopted 2024

Every vendor wants to show you a wall of blinking red lights, because blinking red lights look like value. They’re not. Blinking red lights mean your SIEM is broken and your analysts are drowning.

Our first ninety days on every new client tightens detections, kills the false positives, and leaves a console that only lights up when a human should actually be looking — which is rare, and that’s the point.

01 / What managed SOC solves

You bought the tools.
You still need
eyes at 3 AM.

Every client we onboard already owns security tools — EDR licenses, a SIEM or two, a firewall console, sometimes a full suite. The tools aren’t the gap. The gap is the analyst who reads the alert at 3 AM on a Sunday and decides whether to wake somebody up. Four problems a managed SOC actually solves.

Your SIEM is alerting on everything

Unturned SIEMs generate 300–2,000 alerts per week on a mid-sized fleet. Every alert is a tax on your internal team’s attention. After two weeks nobody reads them, and the one alert that actually mattered gets lost in the chaff. Our first 90 days are a named tuning sprint: we get you to under 40 actionable alerts a week, with written suppression justifications for every rule we silence.

EDR without analysts is a smoke detector nobody listens to

CrowdStrike, SentinelOne, and Defender for Endpoint are exceptional sensors. But a sensor without a human to interpret it is a siren in an empty building. We consume your existing EDR alerts alongside identity, email, cloud, and network telemetry, correlate across sources, and page a human when the pattern actually means something. If you already own the license, we plug in; no rip-and-replace.

Compliance retention is quietly expensive

HIPAA wants six years. PCI-DSS wants one year hot plus three archive. CMMC Level 2 wants logs queryable for active incidents and archived for audit. Most clients cobble this together across three storage tiers and two vendors, and nobody is confident the chain-of-custody holds under audit. Our retention is native: 12 months hot, 7 years cold, integrity-hashed, FedRAMP-Moderate archive available for CMMC-regulated work.

Cyber incidents often become physical incidents

The badge anomaly at 2 AM is a rogue access-point plugged in overnight. The VPN login from an impossible location is because the laptop was stolen from a parked truck. Pure-cyber SOCs file a ticket and hope facilities handles it by morning. We dispatch a licensed officer from the Memphis center to walk the site, pull the device, and secure the scene — usually within the same hour as the alert.

02 / SOC service tiers

Lite, Core, Advanced.
Priced to the risk you actually carry.

Three contracted tiers, three risk profiles. Small offices with one IT person and a Defender license belong on Lite. Most mid-market clients run Core — full 24/7 analyst coverage with pre-authorized containment. Regulated environments, DIB contractors, and targeted-industry clients need Advanced — a named analyst, hypothesis-driven hunts, and an MTTD that starts with a single digit.

What you get	SOC LiteSmall office / SMB fallback	SOC CoreMost mid-market clients	SOC AdvancedRegulated & targeted
Coverage windowWhen humans are watching	Biz hours + after-hours alert	24 / 7 / 365	24 / 7 / 365
MTTD SLAAlert to analyst eyes-on	30 min	10 min	5 min
MTTR SLA (P1)Engagement to first containment	2 hr · manual	30 min · pre-auth	15 min · pre-auth
Analyst modelWho actually sees your alerts	Shared pool	Shared pool · 1:24 ratio	Named lead · 1:8 ratio
EDR / MDR integrationCrowdStrike · SentinelOne · Defender	1 platform	All supported	All supported
SIEM managementLogRhythm · Splunk · Sentinel · Wazuh	Wazuh included	BYO or managed	BYO or managed
Threat huntingHypothesis-driven · MITRE ATT&CK	—	Monthly themed	Weekly custom
False-positive tuning90-day reduction commitment	Quarterly	Continuous · 90-day sprint	Continuous · named engineer
Log retentionHot queryable + compliance archive	3 mo hot · 1 yr archive	12 mo hot · 7 yr archive	12 mo hot · 7 yr FedRAMP
Physical dispatch tie-inOfficer rolls on cyber incident	—	Included · metro	Included · statewide
Quarterly posture reviewWith COO & SOC lead · 90-min session	—	Quarterly	Monthly
Starts atPer endpoint / month · 50+ endpoint min	$18/endpt/mo	$32/endpt/mo	$58/endpt/mo

03 / What we monitor

Six telemetry planes.
One correlated
signal.

A good SIEM is a correlation engine, not a log bucket. We ingest six telemetry planes on every Core and Advanced client, then write detections that cross planes — because the real attacks never live on one plane alone. A compromised identity shows up in endpoint, network, and SaaS logs simultaneously; the job is to connect them before the adversary connects them.

Plane · 01

Endpoints

EDR telemetry from CrowdStrike, SentinelOne, Defender, Sophos, Carbon Black, Cortex XDR, Huntress. Process execution, file-system activity, registry, command-line arguments, parent-child chains, PowerShell and shell logs. Windows, macOS, Linux, server and workstation.

Plane · 02

Network

Firewall logs (Palo Alto, Fortinet, Cisco, Meraki, pfSense), NetFlow, Zeek / Suricata IDS, DNS queries, proxy and web-filter logs, VPN authentication, NAC events, wireless controller telemetry. East-west and north-south, with behavioral baselines per VLAN.

Plane · 03

Cloud

AWS CloudTrail & GuardDuty, Azure Activity & Defender for Cloud, GCP Audit Logs & Security Command Center, Kubernetes audit logs, container runtime telemetry, IaC-drift events. Identity-plane and data-plane separated for proper blast-radius correlation.

Plane · 04

Identity

Microsoft Entra ID (Azure AD) sign-ins, conditional-access decisions, Okta System Log, Google Workspace Admin Audit, on-prem Active Directory 4xxx events, Duo or Cisco ISE MFA logs. Impossible-travel, session-anomaly, privilege-escalation, dormant-account-awakening detections.

Plane · 05

Email

Microsoft Defender for Office 365 / Exchange Online, Google Workspace Gmail audit, Proofpoint, Mimecast, Abnormal Security. Phishing-click detonation, malicious-attachment sandboxing, BEC / impersonation patterns, outbound-exfil and reply-chain-hijack detection.

Plane · 06

SaaS & applications

Microsoft 365 Unified Audit Log, Google Workspace, Salesforce, Slack, GitHub & GitLab audit, Atlassian admin logs, Dropbox / Box / ShareFile, Zoom, any SaaS that emits an audit stream. OAuth-grant abuse, data-exfil via third-party app, anomalous admin role changes.

04 / Alert-handling playbook

From fire
to phone call
in five stages.

Every alert that crosses our SOC queue runs the same five-stage playbook. Each stage is timestamped, every decision is captured, every escalation is documented. Stages 01 and 02 are automated-assisted triage; 03 onward requires a human analyst by policy. We don’t close incidents from dashboards alone.

STAGE 01Receive

Ingest, normalize, correlate

Alert fires in SIEM, EDR, cloud-native control, or email-security platform. Normalized into our common schema within 60 seconds, correlated against sibling events across the six telemetry planes, enriched with asset ownership, criticality tier, known-vulnerability state, and recent change-management history. First auto-disposition pass runs — known-good is suppressed with justification; everything else queues.

STAGE 02Triage

Analyst eyes-on & severity call

Human analyst picks up within the tier SLA (10 min Core, 5 min Advanced). Alert gets a severity assignment — P1 active compromise, P2 suspicious but unconfirmed, P3 informational anomaly, P4 tuning candidate. Every triage call records the analyst’s reasoning, not just the outcome, so disposition decisions are auditable and reviewable in our weekly case-review.

STAGE 03Investigate

Historical pivot & scope determination

Analyst pivots across the 12 months of hot-tier log data to determine scope. How many endpoints? Which identities? What persistence? What data was touched? Investigation artifacts are written into a live case file — queries run, hypotheses tested, evidence captured — with every action time-stamped. If the investigation upgrades severity (P2 becomes P1), stage 04 auto-kicks in parallel.

STAGE 04Contain

Pre-authorized containment action

On P1 confirmed, analyst executes pre-authorized containment under the runbook you signed during onboarding: isolate endpoint via EDR, disable identity, block IOC at firewall, kill mail-flow rule, revoke OAuth token, dispatch a physical officer if a device or location is involved. Every action is reversible and logged. Containment runs in parallel with notification; we don’t wait for your callback to stop the bleeding when the runbook covers it.

STAGE 05Notify

Phone call, channel, written timeline

Designated incident contact called within 15 minutes of P1 confirmation — not a ticket, not an email, a phone call from the analyst who worked it. Slack or Teams incident channel opened within 30 minutes with the case file, evidence, and actions taken. Written incident timeline with full evidence chain delivered within 24 hours of close, plus regulatory-notification-clock assessment if the incident triggers HIPAA, PCI, or state-level breach reporting thresholds.

05 / Stack & vendor posture

Vendor-agnostic
by policy.
BYO-anything welcome.

We take no kickbacks, hold no preferred-partner quotas, and will never push you onto a tool because it’s easier for us to manage. Our named-analyst depth is strongest in the stacks below; we’ll work with whatever you already own, or stand up a fresh deployment on a stack that matches your fleet, your budget, and your compliance obligations. If you’re already paying for Sentinel on an E5 license, we’re not going to sell you Splunk.

SIEM platforms

Our analyst team holds named-platform certifications across all four preferred SIEMs. We run our internal detection content as code, portable across platforms — a detection written once deploys to LogRhythm, Splunk, Sentinel, and Wazuh in parallel with platform-specific query translation.

LogRhythmAxon and on-prem. Primary for mid-market clients on dedicated hardware. Deep SmartResponse automation for containment.
SplunkSplunk Cloud and Enterprise. Primary for data-heavy clients and those already licensed. ES and SOAR integration for Advanced tier.
Microsoft SentinelPrimary for M365-centric clients. BYO-tenant co-management. Workbooks, analytics rules, playbooks, UEBA.
WazuhOpen-source. Our included SIEM on SOC Lite and a cost-sensitive option for sub-50-endpoint Core deployments. Full HIDS + FIM + SIEM.

Elastic Securityco-mgmt Chronicleco-mgmt Exabeamco-mgmt Sumo Logicco-mgmt QRadarco-mgmt

EDR & MDR platforms

We deploy into whatever EDR you already own and operate it as part of the SOC service. No license-lock, no vendor quota, no “switch to our preferred” pressure. The only thing we won’t operate is pure legacy AV with no behavioral component — those we’ll help you replace, on your timeline.

CrowdStrike FalconPrimary for enterprise and DIB clients. Real-Time Response, Fusion workflows, Spotlight, Identity Threat Protection.
SentinelOne SingularityPrimary for Storyline-driven investigations and clients valuing Ranger network-visibility add-on.
Microsoft Defender for EndpointPrimary for M365-centric clients. Defender for Business SKU for sub-300-endpoint. XDR correlation with identity / email / cloud.
Sophos · Carbon Black · Cortex XDR · HuntressFully supported. Huntress common for managed-IT-partner overlay deployments.

No-lock-in deploymentBYO license License pass-throughat cost · optional 30-day transition windowon platform switch

Log retention & compliance archive

Retention is not a checkbox. It’s the difference between being able to hunt across a year of history on a Thursday afternoon, and paying a vendor six figures to restore logs during the one week you actually need them. Our hot tier stays queryable; the cold tier stays trustworthy.

Hot tier12 months queryable. Full-text indexed. Sub-second query latency for common hunts. No restore request required.
Cold archive7 years compressed. SHA-256 integrity hashing per shard. 72-hour retrieval SLA for audit or legal hold.
FedRAMP-Moderate archiveSeparate tenant for CMMC Level 2 regulated content. Chain-of-custody documentation per retrieval.
Immutable writeWORM (write-once-read-many) flagged storage for regulated clients. Tamper-evident with hash-chain receipt delivered per ingest day.

HIPAA6 yr log req PCI-DSS1 yr hot · 3 yr archive CMMC L2audit-ready SOX7 yr FINRA6 yr WORM GLBA5 yr

Threat hunting & detection content

Hunts are hypothesis-driven, not “let’s see what’s interesting.” Every hunt starts with a written hypothesis tied to a specific MITRE ATT&CK technique and a specific threat model for your industry; every hunt produces a written finding, even when the finding is “no evidence observed” — which is itself a useful audit artifact.

MITRE ATT&CK mappingEvery detection tagged to Enterprise tactic and technique. Coverage heatmap delivered quarterly per client.
Industry threat modelsHealthcare (ePHI exfil, ransomware), DIB (nation-state TTPs), retail (POS skimming, card-data stage), finance (wire-fraud BEC).
Detection-as-codeOur detection library is version-controlled, peer-reviewed, and deployed across all client SIEMs with platform translation.
Purple-team feedbackQuarterly internal red-team exercises validate detections. Any missed TTP becomes a net-new detection within two weeks.

06 / Staffing model

Dedicated or shared.
Never anonymous.

Every alert on your account gets seen by a named analyst — not a tier-1 outsource cycling through 800 clients a shift. On Core you’re in a shared pool at a 1-to-24 analyst-to-client ratio; on Advanced you get a named lead and a 1-to-8 ratio. You know who triaged your alert, and you can get them on a call if the written timeline needs a human voice behind it.

Shared-pool model (Core)

Ratio1 analyst : 24 clients during active shift. Well below the 1:60 industry-average MSSP ratio that creates the “analyst never actually looked at your alert” problem.

Tier structureTier-1 triage, Tier-2 investigation, Tier-3 hunt. Your alert always rises to Tier-2 the moment it’s confirmed as anything above informational. No alert dies in Tier-1 by default.

Shift model24/7/365 with three 8-hour shifts plus a floating on-call. North-American staffed; no offshore tier-1 handoff. Memphis primary, Nashville secondary, Austin tertiary for geographic failover.

RetentionSOC analyst 12-month retention 83% — above the 58% industry average. Low churn means the analyst who knows your environment this quarter is still the one triaging next quarter.

CertificationsEvery analyst holds at minimum GCIH or CySA+. Tier-2 adds GCFA, GCED, or GNFA. Tier-3 adds GCIA, GCTI, or OSCP. We publish the full cert roster on your quarterly review.

Named-lead model (Advanced)

Ratio1 named lead : 8 clients with full context on your environment, your threat model, your runbook. The same lead attends your quarterly reviews and owns the detection-engineering backlog for your account.

Team structureNamed lead + 2 secondary analysts + 1 detection engineer aligned to your account. The lead quarterbacks, the secondaries cover when the lead’s off-shift, the engineer writes your custom detections.

Hunt cadenceWeekly hypothesis-driven hunts customized to your industry threat model — never the same hunt twice across a quarter. Written finding on every hunt, even negative results.

Response coordinationOn P1 confirmation, named lead quarterbacks the incident through closure with DFIR team joining automatically for forensic preservation. No hand-off between analyst and responder.

Monthly posture90-minute review with COO, SOC lead, and your security stakeholder. Coverage heatmap, detection gaps, hunt findings, FP trend, recommendations queued for the next month.

07 / Managed SOC FAQ

Everything a CIO,
CISO, or IT director
actually asks.

The real questions from RFPs, vendor due-diligence calls, and security-committee meetings. Answered specifically for TN and MS operating environments. If yours isn’t here, call (202) 222-2225 — a senior SOC lead will answer in real time.

Q · 01Do I need a managed SOC if I already run EDR?

EDR is a sensor, not a response. CrowdStrike, SentinelOne, and Defender for Endpoint generate hundreds of alerts a week on a mid-sized fleet; without analysts to triage, the bulk sit in a console nobody is reading on a Tuesday at 2 AM. A managed SOC consumes those EDR alerts alongside firewall, identity, email, and cloud telemetry, correlates them into actual incidents, suppresses the false-positive chaff, and calls a human at 2 AM when a ransomware staging pattern actually shows up. If you already own EDR, you’re most of the way to SOC Core — we just add the analysts and the 24/7 eyes.

Q · 02What’s the difference between MDR and MSSP?

An MSSP (Managed Security Services Provider) is the older model — they typically forward you tickets from a SIEM, manage your firewall rules, and hand you 200-page reports nobody reads. MDR (Managed Detection and Response) is outcome-focused: analysts own the detection, triage, and containment loop on your behalf, and are measured on MTTD and MTTR rather than ticket volume. We operate as an MDR provider with MSSP-style transparency — you get the containment authority and detection outcomes of MDR, plus full access to every log, every query, and every custom detection we build for your environment. No black-box dashboards, no “call us for the raw data” nonsense.

Q · 03How do you handle false positives?

False positives are the core failure mode of bad SIEM operations — analysts get fatigued, real alerts get missed, clients lose trust in the console. We run a named false-positive tuning cycle on every new client for the first 90 days: every triaged alert is tagged with a disposition, recurring FPs get a suppression rule written into the SIEM with a justification comment, and every suppression gets re-reviewed every 90 days so stale suppressions don’t hide real signal. Typical client goes from 300+ alerts/week in week one to under 40 actionable alerts/week by day 90. We publish the FP rate as a monthly line item — if it’s creeping above 15%, that’s a tuning review trigger, not a “we’ll get to it.”

Q · 04Do you replace my IT team?

No. We complement them. Your IT team owns endpoint deployment, patching, identity provisioning, and the day-to-day operations of the systems we monitor. We own the detection, triage, and escalation loop on top of their work. When we catch something — say, a suspicious service account login from Lagos at 3 AM — we investigate, contain if authorized, and hand the remediation work to your IT team with full context: what happened, what we did, what they need to do. Your IT team stops being the midnight escalation for every Defender alert that could be anything; we are. Many of our clients tell us their IT team reclaims 8–14 hours a week of reactive alert-chasing once we’re live.

Q · 05What’s your P1 alert response time?

P1 is defined as confirmed active compromise, ransomware staging, data exfiltration in progress, or privileged account takeover. On SOC Core the SLA is 10 minutes from alert fire to analyst engagement, with containment authorized within 30 minutes. On SOC Advanced it tightens to 5 and 15 minutes. In practice our 2025 YTD metro median for P1 engagement is 3 minutes 42 seconds — faster than the SLA because P1 alerts page the named on-call analyst directly, not the shared queue. If a P1 breaches SLA on your account, the monthly invoice automatically credits a percentage of base fee; you don’t file a ticket, the system credits itself.

Q · 06Can you integrate with my existing SIEM?

Yes. We deploy into whatever you already have, or we rebuild on our preferred stack — your call. We have named-analyst-certified depth in LogRhythm, Splunk (Cloud & Enterprise), Microsoft Sentinel, and Wazuh (our open-source option for cost-sensitive clients and smaller fleets). We also operate Elastic Security, Chronicle, Exabeam, Sumo Logic, and QRadar environments on a co-management basis. If you’re already licensed on Splunk and happy with it, we don’t ask you to rip-and-replace — we just stand up our analyst team on top of your existing instance and write the detections you’re missing.

Q · 07Do you support bring-your-own cloud SIEM?

Yes. BYO cloud SIEM is actually our most common pattern for M365-centric clients — you already pay for Microsoft Sentinel on your E5 license, so we simply build out the connectors, ingest rules, workbooks, and detection content in your Azure tenant and operate it under co-management. Your data stays in your tenant, your license stays in your Microsoft agreement, and we bring the analyst hours and the detection engineering. Same pattern works for Splunk Cloud, Elastic Cloud, Chronicle, and Sumo Logic. No data egress to a vendor cloud, no second SIEM bill, full admin transparency in your own console.

Q · 08What does “tied to physical dispatch” mean for a cyber SOC?

Most cyber incidents have a physical component — a badge that shouldn’t have worked, a rogue access-point plugged in overnight, a server-room door propped open, a disgruntled ex-employee tailgating into a field office. When our SOC analysts see a badge anomaly or an unauthorized device on the network, we can dispatch a licensed officer from the Memphis center to walk the site, verify what’s happening, pull the device, and secure the scene — often within the same hour. Pure-cyber SOCs can’t do that; they file a ticket and hope your facilities team handles it by morning. Our 24/7 physical dispatch is already live for the alarm-response side of the business, so tying the cyber SOC into it was a natural step. Metro coverage is included on Core; statewide on Advanced.

Q · 09How long do you retain logs, and what about compliance archive?

Standard retention is 12 months hot (queryable, indexed, available for real-time hunting and incident investigation) plus 7 years cold archive (compressed, SHA-256 integrity-hashed per shard, retrievable within 72 hours for audit or legal hold). The hot tier lets us hunt historically across an entire year of logs without a restore request; the cold tier meets the long-tail retention clauses in HIPAA (6 year minimum), PCI-DSS (1 year hot + 3 year archive), CMMC Level 2, FINRA, SOX, GLBA, and most state-level breach-notification statutes. For CMMC-regulated clients we additionally write logs to a FedRAMP-Moderate archive in a separate tenant, with chain-of-custody documentation maintained for every retrieval.

Q · 10What platforms and vendors do you support for EDR?

We are vendor-agnostic on EDR by policy — no kickbacks, no “preferred partner” quotas, no lock-in. Our named-analyst depth is strongest on CrowdStrike Falcon, SentinelOne Singularity, and Microsoft Defender for Endpoint (including the Defender for Business SKU for sub-300-endpoint clients). We also fully support Sophos Intercept X, Carbon Black, Cortex XDR, and Huntress (which we recommend for managed-IT partners who want us to layer detection on top). If you already own a license, we deploy into it. If you’re greenfield, we recommend based on your fleet size, OS mix, and budget — and we’ll quote you the license through us at cost or point you at a direct-to-vendor buy, your call. License pass-through is never marked up.

Q · 11What about threat hunting — is it included or extra?

SOC Core includes monthly themed hunts mapped to MITRE ATT&CK (e.g., one month we hunt lateral-movement patterns, next month persistence mechanisms, then defense-evasion, then credential-access — rotating through the matrix over a quarter). SOC Advanced includes weekly hypothesis-driven hunts customized to your environment and industry threat model — e.g., for a healthcare client we might hunt for ePHI staging behavior, for a defense contractor we hunt for nation-state TTPs seen in DIB-targeting campaigns. Every hunt produces a written finding, even when the finding is “no evidence observed” — that negative result is itself valuable for audit trails and board reporting.

Q · 12What happens when an alert becomes a confirmed incident?

The analyst who triaged the alert stays with it — we do not hand off mid-incident. On SOC Core, the analyst contains (isolate host, disable account, block IOC at firewall/EDR) under pre-authorized containment authority captured in your onboarding runbook, then pages our incident-response lead for anything beyond simple containment. On SOC Advanced, the named analyst quarterbacks the whole incident through closure, with our DFIR team joining automatically for forensic preservation. Either way, you get a live Slack or Teams channel opened for the incident, a phone call to your designated incident contact within 15 minutes of confirmation, and a written timeline with evidence chain delivered within 24 hours of close, plus a regulatory notification-clock assessment if the incident triggers HIPAA, PCI, or state-level breach reporting thresholds.

Q · 13How long does onboarding take?

Standard onboarding is 14 days from signed contract to full 24/7 coverage. Day 1–3 is discovery and runbook build: asset inventory, crown-jewel identification, pre-authorized containment scope, designated incident contacts, escalation matrix. Day 4–9 is connector deployment and data-flow validation: every telemetry plane wired into the SIEM, detection content deployed, parsing validated, alert routing tested. Day 10–14 is a parallel-run period where we watch the console live, baseline your FP volume, and start the 90-day tuning sprint. Go-live is day 14. For BYO-Sentinel M365 clients we routinely cut that to 9 days because half the connectors are already running.

08 / Next Step

Quiet the console.
Keep the signal.

A senior SOC lead will review your current tooling, your compliance obligations, and your alert volume, then deliver a written SOC proposal with tier recommendation and tuning-sprint plan inside five business days. No cost, no pitch, no rip-and-replace required on your existing security stack.