Connecting event sources
Network equipment, servers, endpoints and cloud services send their logs to one platform.
Service 01 · Monitoring and response
SOC as a Service
Centralised protection for your company: collection and analysis of security events, timely notification and elimination of cyber threats — without building your own monitoring centre.
What’s included
The full cycle: from event to closed incident
Correlation and detection rules
We match events across systems to see attacks that are invisible at the level of a single device.
Triage and investigation
An analyst filters out false positives and establishes the scope and root cause of an incident.
Notification and escalation
You receive a contextual message with a severity assessment and recommended actions — not raw alerts.
Response and remediation
We contain the threat according to an agreed playbook and support the clean-up.
Regular reporting
Reports for IT and management: incidents, trends, recommendations for stronger protection.
Which systems we connect
The list of sources is agreed at the start — around your critical assets.
- Network equipment and NGFW (Fortinet)
- Servers and virtualisation
- Endpoints
- Web applications and WAF
- Cloud services
- Mail and office services
Responsibilities
Who does what — agreed before go-live
| Activity | Bereg-IT | Client |
|---|---|---|
| Event monitoring and detection | Performs | — |
| Triage and investigation | Performs | Provides context |
| Isolating business-critical systems | Proposes and performs | Approves |
| Access and source onboarding | Configures | Provides |
| Root-cause remediation | Recommends / performs under contract | Approves |
| Reporting | Prepares | Receives |
Service parameters
Clear commitments, written into the contract
No averages. Every parameter is agreed for your risk profile and fixed in the SLA.
Fixed in the SLA
Monitoring hours
Coverage schedule matched to the criticality of your systems and your business hours.
Fixed in the SLA
Response time
Set separately for each incident severity level.
Fixed in the SLA
Log retention
Retention period that takes your industry’s regulatory requirements into account.
Fixed in the SLA
Reporting
Frequency and format of reports for IT and management.
Onboarding
How the launch works
- Sources and risksWe identify the critical assets and the systems to connect first.
- Onboarding and baselineWe collect logs and learn the normal behaviour of your infrastructure.
- Tuning detectionWe adapt the rules to your environment and agree response playbooks.
- OperationsContinuous monitoring, response and regular reports.
FAQ
How is a SOC different from antivirus?
Antivirus protects a single device. A SOC collects events from the network, servers, endpoints and cloud, correlates them and detects attacks that are not visible on any single device.
Can we start with an audit?
Yes. A free consultation and an audit show which event sources are critical and what to connect first.
Who decides whether to isolate a system?
We agree the procedure before go-live: for business-critical systems — with the approval of your designated contact; for typical scenarios — under pre-approved rules.
Related services
Let’s work out what you should monitor
The first consultation is free. contact@beregit.com