Bloomwiz Security · SOC
SOC as a Service
24x7 monitoring, detection and response, without building a security operations centre. Delivered with our specialist SOC partner, managed through Bloomwiz as your single point of accountability.
- Monitor, Detect and Respond, Co-managed
- Detections mapped to MITRE ATT&CK
- Production actions need your approval
- One point of accountability
The gap
Why most companies cannot run their own
A security operations centre needs people on shift around the clock, a platform to collect and correlate logs, detection content that is maintained as threats change, and response procedures that have been rehearsed. For most organisations below enterprise scale, that is not a staffing problem. It is an impossibility.
The alternative is usually alerts nobody reads, in a tool nobody owns, discovered weeks after the event.
Service levels
Coverage levels
Monitor
Log collection, alert triage and escalation during agreed hours. Suitable for organisations whose first requirement is visibility and a clear escalation path.
Detect and Respond
24x7 monitoring with investigation and guided containment. Endpoint detection and response included. Monthly reporting on what was seen, what was investigated and what was closed.
Co-managed
For organisations with their own IT or infrastructure team. Shared console and shared ticket queue, with responsibilities split explicitly so nothing falls between the two parties.
Visibility
What gets monitored
Detections are mapped to MITRE ATT&CK, so coverage can be described in terms of attacker behaviour rather than product features.
- Endpoints and servers
- Cloud platforms across AWS, Azure and Google Cloud
- Identity and authentication
- Network and perimeter devices
- SaaS applications
Getting started
Onboarding
- 01
Discovery
Estate, log sources, existing tooling and escalation contacts.
- 02
Connect
Log sources onboarded in agreed phases, highest value first.
- 03
Tune
Detections tuned against your environment to bring alert noise down before go live.
- 04
Rehearse
Escalation and response procedures walked through with your team.
- 05
Operate
Live monitoring, with a defined review cadence.
Response
Severity and escalation
Incidents are classified by severity, and each severity has its own escalation path and named contacts. Containment actions that affect production are agreed with you in advance and require your approval before they are taken. The specific commitments that apply to your environment are set out in your service agreement.
Deliverables
What you receive
- Alerting and escalation to named contacts, through an agreed channel.
- Incident records with a full timeline, from detection to closure.
- A monthly report covering activity, incidents, trends and recommended actions.
- Written post incident summaries for anything significant.
- A quarterly review of coverage, detection health and whether the service still fits the estate.
Together
Where this connects to the rest
Monitoring tells you what is happening now. Testing tells you what could happen. Clients who take both get detections tuned against the weaknesses their own penetration test identified, which is a materially better position than either service alone.
FAQ
Frequently asked questions
What is a SOC?
A security operations centre is the function that watches an organisation’s systems around the clock, detects suspicious activity, investigates it and coordinates the response.
Who is accountable for the service?
Bloomwiz. The service is delivered with our specialist SOC partner and managed through Bloomwiz as your single point of accountability.
Will you change things in our production environment without asking?
No. Containment actions that affect production are agreed with you in advance and require your approval before they are taken.
What is MITRE ATT&CK?
MITRE ATT&CK is a public knowledge base of adversary tactics and techniques. Mapping detections to it lets coverage be described in terms of attacker behaviour.
Talk to us
Not sure where to start?
A thirty minute conversation, no charge, and an honest view of what you actually need first. Most companies need less than they fear and something different from what they expected.