Question 1

What differentiates a Managed SOC from an internal IT team?

Accepted Answer

An internal IT team focuses on availability -- patches, updates, helpdesk. A Managed SOC specializes in attack detection: 24/7 monitoring, threat intelligence, incident response. Building an in-house SOC costs several hundred thousand euros per year (personnel, tools, training) -- a managed service delivers the same coverage at a fraction of the cost and is immediately operational.

Question 2

Which systems are monitored?

Accepted Answer

The DeltaSecure SOC integrates logs from four areas: (1) Network, infrastructure, and OT (firewalls, IDS/IPS, servers, virtualization), (2) Users & identities (Active Directory, logins, audit logs), (3) Endpoints and applications (Windows/macOS, database access, custom apps), (4) Public and private cloud (Microsoft 365, Azure, AWS, GCP).

Question 3

What is the difference between 8x5 and 24x7 service?

Accepted Answer

8x5 service covers weekdays from 08:00-18:00 -- suitable for companies with clearly defined office hours and a lower risk profile. 24x7 service is recommended for critical infrastructure operators, financial services, hospitals, and all companies that operate around the clock or have regulatory 24/7 monitoring obligations (e.g., NIS2, B3S, BAIT/DORA).

Question 4

How does threat hunting work?

Accepted Answer

Threat hunting is the proactive search for attackers who have evaded signature-based detection. DeltaSecure analysts use MITRE ATT&CK hypotheses, IOC feeds, and behavioral analytics to uncover anomalies such as living-off-the-land techniques, lateral movement, or data exfiltration -- before damage occurs.

Question 5

Which SIEM platform is used?

Accepted Answer

DeltaSecure is vendor-agnostic and works with leading enterprise SIEMs: Splunk, Elastic, Microsoft Sentinel, IBM QRadar, ArcSight, and LogPoint. We select the platform that fits your existing infrastructure -- or bring our own platform if you prefer to avoid vendor lock-in.

Question 6

What SLAs apply to security incidents?

Accepted Answer

Standard SLAs: P1 incidents (critical, e.g., active ransomware attack) -- response within 15 minutes. P2 (high) -- 1 hour. P3 (medium) -- 4 hours. Individual SLAs are defined in the contract and can be tightened for specific industries (e.g., critical infrastructure).

External Cybersecurity Department -- Your peaceful sleep is our mission.

Managed SOC

Visibly secure

Frequently Asked Questions

Clients

External Cybersecurity Department -- Your peaceful sleep is our mission.

Managed SOC

Visibly secure

Frequently Asked Questions

Clients