FAQs

SIEM management is the ongoing administration and maintenance of a security information and event management platform. It can include data integrations, ingestion health, detection rules, access, configurations, and usage reviews. The service scope identifies which components the provider manages.

Pricing reflects coverage, workload, supported tools, investigation responsibilities, governance, and required expertise. Onboarding, platform licensing, standby availability, and activated on-call work are identified separately where applicable.

The service establishes workload assumptions and escalation arrangements for unusual demand. We review increases caused by incidents, new integrations, or recurring noisy detections, then agree priorities and any required capacity or scope changes.

These activities are not automatically included in routine SOC operations. Proactive threat hunting, forensic investigation, malware analysis, and recovery require their own scope and specialist capability. The proposal identifies any included activities and the arrangements for additional expertise.

Measures are selected around the work being delivered. They may include alert acknowledgement, triage and escalation times, case backlog, investigation quality, and handover completion. Each measure defines when timing starts, the applicable coverage hours, and how dependencies are recorded.

The response matrix defines the owner for each action. Innoraft may investigate, escalate, coordinate, or perform specifically authorized containment actions within scope. Actions affecting business systems follow the agreed approval process. Remediation ownership is documented separately.

These requirements can be included in service planning. We confirm the named time zone, working days, shift times, paging criteria, and backup arrangements before committing to a schedule. PagerDuty access and escalation paths are tested during onboarding.

Monitoring hours are explicitly stated in the proposal. Scheduled monitoring, extended coverage, and on-call incident availability are different arrangements. We confirm the staffing and backup model for the coverage we commit to; round-the-clock monitoring should not be assumed.

The terms can overlap, but the actual responsibilities matter more than the label. MDR offerings commonly include defined detection and response capabilities across supported technologies. Our proposal specifies the monitoring, investigation, and response activities included, so you can compare services on scope.

Yes. Innoraft can manage an agreed portion of your SOC operations alongside your internal team or existing provider. Queue ownership, investigation responsibilities, handovers, and escalation paths are established before the transition.