# SOC Capabilities

Inside SOClogix's 24/7 Security Operations Center - analyst structure, detection engineering pipeline, tooling stack, and SLA commitments for every incident priority.

**24/7**  
**365-day coverage**  
**<15 min**  
P1 acknowledgment SLA  
**4-tier**  
Analyst structure  
**100%**  
U.S.-based analysts

## Analyst Structure

Every alert moves through a defined escalation path. Tier 1 catches it. Tier 2 investigates it. Tier 3 turns it into a new detection. Senior IR leads the response when it matters most.

### Tier 1
**Alert Triage**  
- First responders for all incoming alerts across every client environment  
- Alert enrichment, deduplication, and initial classification  
- 24/7 watch rotation - no gaps, no forwarded voicemails  
- Escalates to Tier 2 on any P2 or higher indicator

### Tier 2
**Threat Investigation**  
- Deep-dive log correlation and attack timeline reconstruction  
- Malware identification, classification, and behavioral analysis  
- Direct client communication on P1 and P2 incidents  
- Escalates to Tier 3 for complex multi-system or identity-layer compromises

### Tier 3
**Detection Engineering & Hunting**  
- Proactive threat hunt campaigns mapped to current adversary TTPs  
- Detection rule authoring, peer review, and CI/CD-tested deployment  
- MITRE ATT&CK coverage tracking and gap analysis  
- Rule performance monitoring - FP rate, signal quality, MTTD impact

### Senior IR
**Incident Response Lead**  
- On-call 24/7 for confirmed P1 incidents and active breaches  
- Executive briefings, board communication, and regulatory guidance  
- Forensic investigation oversight and breach containment strategy  
- Leads the Breach Concierge program for covered organizations

## SLA Commitments

Response times are contractual, not aspirational. Every priority level has a defined acknowledgment window, triage target, and notification path.

| Priority | Definition | Acknowledgment | Triage Target |
|----------|------------|----------------|---------------|
| P1 - Critical | Active breach, ransomware detonation, confirmed data exfiltration | Phone + email, Senior IR Lead engaged | 5 min | 30 min |
| P2 - High | Confirmed malicious activity, high-confidence IOC match | Email + client portal update | 10 min | 1 hr |
| P3 - Medium | Suspicious activity, anomaly requiring investigation | Client portal notification | 15 min | 4 hrs |
| P4 - Low | Informational alerts, policy violations, routine observations | Included in monthly report | 30 min | 24 hrs |

## Tooling Stack

Purpose-built for detection engineering. No legacy SIEM tax, no bloated platform licenses - just the tools that actually produce signal at the speed attackers move.

### LimaCharlie
Cloud-native telemetry & response platform

### OpenSearch SIEM
Log ingestion, correlation & analytics

### Microsoft Defender
M365 & endpoint telemetry integration

### Entra ID / AD
Identity telemetry & ITDR monitoring

### Threat Intel Feeds
Commercial + OSINT IOC enrichment

### Detection Pipeline
Git-versioned, CI/CD-tested rule deployment

### MITRE ATT&CK
Coverage mapping across all detection rules

### Proofpoint / EOP
Email threat protection & phishing analysis

## Detection Engineering Pipeline

Every detection rule in production passed through peer review and automated testing before it saw a single client environment. Detection is code - it gets treated that way.

01  
### TTP Research  
Analyst team tracks active threat actor campaigns, newly published CVEs, and emerging attack techniques from commercial and OSINT sources.

02  
### Hunt Hypothesis  
Tier 3 engineers develop a detection hypothesis: what behavior would this TTP produce in telemetry, and where would it appear?

03  
### Rule Authoring  
Detection rules are written against the LimaCharlie D&R engine with test cases. Every rule maps to one or more MITRE ATT&CK (sub)techniques.

04  
### Peer Review  
A second Tier 3 engineer reviews logic, false-positive risk, performance impact, and coverage before the rule proceeds to testing.

05  
### CI/CD Pipeline  
Automated test suite validates rule syntax, logic, and expected behavior against synthetic telemetry before any production deployment.

06  
### Deploy & Monitor  
Rules ship to all applicable client environments. Signal quality (FP rate, MTTD) is tracked continuously and rules are tuned when needed.

## What You Can Hold Us To

These are not marketing claims. They are contractual commitments that define how SOClogix operates for every managed client, every day.

- 24/7/365 SOC coverage - no holidays, no blackout windows  
- 100% U.S.-based analysts - no offshore escalation paths  
- Named analyst contacts for your account  
- Monthly threat reports with alert volume, incident summaries, and recommendations  
- Quarterly detection coverage reviews against MITRE ATT&CK  
- On-site incident response capability across the Baltimore, Charlotte, and Knoxville regions

### Ready to see the SOC in action?

Book a technical briefing with our Tier 3 team. We will walk through our detection coverage, show you the tooling, and answer questions about how your specific environment would be onboarded.

Onboarding typically completes within 5 business days  
SOC monitoring begins at go-live, not after a 30-day ramp  
SOC Briefings Available

## Built to Detect. Trained to Respond.

Schedule a briefing with our SOC leadership team. We'll walk through our detection stack, demonstrate a live playbook execution, and talk through what monitoring your environment would look like.