Infigo Expert Service
SOC with Infigo
A 24/7 managed SOC delivered by Infigo on your Elastic or Splunk environment, with analysts who monitor, investigate and alert you to threats, so you know about an attack before it spreads.
Solution overview
SOC with Infigo adds round-the-clock monitoring and investigation to your Elastic or Splunk environment. Infigo analysts monitor security alerts, investigate threats and notify your team. The Elastic-based service includes three analyst tiers, threat hunting, detection tuning, incident reports and monthly reporting.
Your business needs
Keep watch beyond office hours
Alerts left unattended
Your SIEM collects security data, but your team cannot monitor alerts throughout nights, weekends and holidays.
Limited specialist capacity
Continuous monitoring requires specialist coverage across shifts, investigations and escalations. Your organization does not have its own 24/7 team.
Existing SIEM investment
Your Elastic or Splunk environment needs analysts who monitor, investigate and notify your team when threats are identified.
Who this is for
Analyst coverage for your security operations
For organizations using Elastic or Splunk that need monitoring beyond the coverage their internal team can provide.
CISO / CIO
A managed SOC that provides monitoring, investigation and threat notification around the clock.
Security / IT Operations
Analysts who investigate alerts and notify your team of identified threats.
Elastic platform owners / Data protection
For the Elastic-based service, a defined CCS connection and time-limited analyst access through SECURIX JIT Access, with an audit trail.
Our deliverables
Monitoring and investigation on your existing SIEM
SOC with Infigo is available on Elastic or Splunk. The following detailed service scope describes the Elastic-based offering.
- 24/7/365 monitoringContinuous monitoring, triage and correlation by Infigo analysts.
- Incident investigation and response supportInvestigation, escalation and recommendations for responding to security incidents.
- Incident reportsReports describing and categorising the incidents, with recommended measures.
- Minor adjustmentsUp to half a person-day for minor adjustments per month.
- Three analyst tiersTier 1 monitors and assesses alerts. Tier 2 investigates incidents in the components affected. Tier 3 carries out forensic analysis and supports remediation once a security incident is confirmed.
- Threat hunting and detection tuningThreat hunting and tuning of detection content.
- Monthly reporting and SLA governanceService reporting covering KPI performance, triaged alerts, investigated incidents and analysis of relevant incidents.
- Independent containment
- SIEM implementation and data onboarding
- Custom development and larger changes
- Manual penetration testing and red teaming
How we deliver
Connect your Elastic environment to round-the-clock monitoring
-
Begin onboarding with the customer coordinator and incident contact.
-
Connect the customer cluster through Cross-Cluster Search using the customer-issued API key and the required network access.
-
Establish contacts, escalation and reporting processes, and tune the service.
-
Infigo analysts monitor the connected environment around the clock using centrally managed detection rules.
This onboarding model applies to the Elastic-based service. Once CCS is connected, central detection rules provide coverage without data migration or per-customer analyst onboarding.
Elastic connection and access
Keep control of data and analyst access
Data storage
Raw data stays in your own Elastic cluster. Alerts and search results are held in the central SOC cluster in SECURIX’s data center in Switzerland.
A connection controlled by the customer
Your organization issues the API key that defines the access scope and can revoke it at any time.
SECURIX JIT Access
Analysts request access with a written reason. Once approved, access is granted for a limited period and removed automatically when it expires. Requests, approvals and access are logged and reported to you.
Analyst location
Infigo analysts work from Croatia and view search results through JIT Access.
Technical prerequisites
The customer cluster requires an Enterprise license, a CCS connection and an Elastic version no more than two minor releases behind the latest.
Technology partners
Platforms for SOC with Infigo
The service is available on Elastic and Splunk.
Frequently asked questions
Good to know before your SOC service starts
Yes. SOC with Infigo is available on Elastic or Splunk. The CCS, JIT Access and data-handling model described on this page applies to the Elastic-based service.
Raw data stays in your own cluster. Alerts and search results are stored in the central SOC cluster in SECURIX’s data center in Switzerland. Infigo analysts access search results from Croatia through JIT Access.
For the Elastic-based service described here, containment is advisory or customer-approved. Infigo does not execute containment independently.
SOC with Infigo provides monitoring, investigation and threat notification on Elastic or Splunk. MDR with Infigo runs on CrowdStrike and includes containment through isolation of affected devices.
Contact
Let’s discuss your next step
Tell us how your security alerts are monitored today. Together, we’ll clarify how SOC with Infigo can support your team.
