Managed Detect, respond, recover
Managed SIEM and SOC
If nobody on your team has time to watch the alerts, the one that matters gets missed. Our in-house UK SOC watches for you, at a price that makes sense for an SME.
- Analysts
- UKour own team, in house
- Hours
- 9×5extended 8×8 on a best-endeavours basis
- Option
- 24/7out-of-hours cover through our partners
- One team
- MSSPalso runs your EDR, firewall and email
01 / The problem
Somebody has to read the alerts.
Alerts drown the real threat
A SIEM raises thousands of alerts a day. Without someone to triage them, the one that matters gets missed.
Analysts are hard to hire
A SOC needs skilled people. Hiring and keeping them is hard even for large firms.
Big-vendor SOCs are priced for big firms
Round-the-clock services are built for enterprises. Many SMEs pay for cover they don't need, or go without.
02 / What’s included
From log ingestion to containment.
Managed SIEM and log analytics
We deploy, tune and run the SIEM (security information and event management), pulling logs from endpoint, cloud, network and identity.
Attack surface monitoring
Ongoing checks on your internet-facing domains, IPs, certificates and services.
Dark web monitoring
We watch criminal markets and forums for your credentials, data and brand.
Threat intelligence
Every alert enriched and mapped to known attacker techniques (MITRE ATT&CK).
Containment
When a threat is real, we act: isolate the device, suspend the account, block the address.
24/7 cover
Need eyes on the estate overnight and at weekends? We add out-of-hours monitoring and response through our specialist partners, run and reported by us.
Not sure what cover you need? Scope your SOC in a few minutes with our online tool.
03 / How it works
From onboarding to operational.
- Discover and design We assess your environment, log sources and risk, then agree the cover you need.
- Deploy and integrate Collectors in, logs flowing, endpoint and cloud connected, baseline rules set.
- Tune and validate We suppress known noise and test detections against real attack scenarios.
- Monitor and respond Live monitoring starts, with a monthly report and a quarterly review.
Most SMEs don't need a 24/7 SOC on day one. They need someone who reads the alerts and acts on them.
How the ITB SOC works
04 / Why ITB
A SOC sized and priced for SMEs.
Our in-house SOC runs in UK working hours, extended to 8×8 where we can. That keeps it affordable for smaller organisations. If you need round-the-clock cover, we add it through our partners, and you still deal with one team. Because we also run your EDR, firewalls and email security, we can act across the whole stack, not just raise a ticket.
| What it takes | Build in-house | Run it with ITB |
|---|---|---|
| Analysts | Hire and train your own | Our UK team, in house |
| Out-of-hours cover | A rota of at least [x] people | Optional, through our partners |
| SIEM licences and tuning | Bought, built and tuned by you | Included and tuned |
| Containment across EDR, firewall, email | Depends who runs each tool | One team, agreed playbooks |
| Board reporting | Built from scratch | Monthly report, quarterly review |
· 05 / Questions
Managed SOC, plainly answered.
Q01 Is your SOC 24/7?
Our in-house SOC covers UK working hours (9×5), extended to 8×8 on a best-endeavours basis. That suits most SMEs and keeps the price down. If you need 24/7, we add out-of-hours cover through our specialist partners, and we stay your single point of contact.
Q02 What log sources do you support?
Endpoints, firewalls, Azure, AWS and GCP, Microsoft 365, identity providers such as Entra ID and Okta, SaaS apps, VPNs and on-premise kit. We deploy the collectors and parse the logs.
Q03 Do you respond, or just alert?
Both. We isolate endpoints, suspend accounts, block addresses and end sessions, using playbooks you approve at onboarding.
Q04 How does dark web monitoring work?
We scan criminal markets, forums, paste sites and encrypted channels for your domains, credentials and data. If we find something, you get an alert and the steps to fix it.
Q05 Do we need EDR as well?
The SOC is strongest when it can act on the endpoint. If you don't have EDR (endpoint detection and response), we'll recommend it, and we can run it as part of the same service.
Related services
EDR / XDR / MDR
The endpoint layer our SOC acts through.
See the serviceVulnerability & Critical Patch Management
Fewer holes means fewer alerts.
See the serviceIRaaS
For the incident that needs more than containment.
See the serviceFirewall / NDR
Network detection that feeds the SOC.
See the service· [Placeholder]
[Placeholder] [Placeholder]
[Placeholder: written by ITB]