Security Operation Center

A wide spectrum of technologies can be integrated into the service—from firewalls and network devices to internal applications or cloud services. Thanks to the centralized collection and analysis of security events, the customer gains a comprehensive overview of the security posture across their entire infrastructure.

Building an in-house security operations center is financially and operationally demanding for many organizations. The SOC as a Service model allows for professional security monitoring without the need to build an internal surveillance infrastructure and team. Through the Aricoma Cyber Defense Center, we provide a comprehensive, service-based solution for managing cybersecurity events and incidents. This service minimizes response times to cybersecurity events and incidents, thereby reducing the resulting damages.

1. Continuous collection, normalization, categorization, and correlation of information (not limited to logs) through technological solutions.
2. Intake of detected findings and initiation of the security event and incident management process, starting with Short Event Triage to validate whether a real threat exists.
3. Detailed analysis of security events and their final evaluation to determine whether they constitute security incidents or false positives. In the case of false positives, feedback is provided to enhance security, particularly regarding the detection mechanisms of individual security components and other infrastructure elements. Upon detection of a security incident (confirmation that it is not a false positive), it is subjected to a formal investigation within the cybersecurity event and incident management framework.
4. We conduct cybersecurity incident investigations to determine the attack vector, impact, and other information necessary for incident resolution and the definition of an adequate response.
5. We then propose a response and cooperate during its implementation. Upon request, we can also provide coordination during cybersecurity incident management by assuming the role of Incident Coordinator or by requesting the intervention of a reactive CSIRT team.
6. Post-incident activities, consisting primarily of documentation and recommendations for further security development.