Everyday Tasks
Customer Operational Guide
Overview
This document outlines your operational responsibilities based on your ThreatDefence service subscription. We offer two primary service models to match your organization's security maturity and resource availability.
Managed SOC Service
Full security operations outsourcing. Our team manages detection, triage, and initial response.
Respond to Escalations - Review and act on critical requests from our SOC.
SIEM Platform Only
Self-managed security operations. You retain full control of detection and response using our platform.
Daily Triage - Actively monitor and manage security alerts within the platform.
1. For Managed SOC Customers
Your Role: The Incident Commander
When you subscribe to our Managed SOC service, our security analysts become an extension of your team. We handle the 24/7 monitoring, investigation, and initial containment, allowing you to focus on strategic business decisions.
Primary Responsibility: Respond to Escalations
You will receive critical notifications via email or phone when our SOC requires your input or action.
These escalations are typically for:
Validation: "We see a critical action from user [X]. Is this authorized?"
Action: "We have contained a threat on endpoint [Y]. Please inform the user."
Decision: "An incident has been declared. Activate your incident response plan."
Technical Requirement:
No daily login to the platform is required.
You only need to monitor the communication channels (email/phone) used for escalations.
Strong Recommendation: Leverage the Platform for Awareness
While not mandatory, logging into the Security Dashboard provides significant benefits:
Operational Awareness: View real-time security posture, active incidents, and threat trends.
Skill Uplift: Observe how our analysts investigate and respond to threats—a free training resource for your team.
Proactive Oversight: Access customized reports and dashboards for compliance and management reviews.
Best Practice: We recommend a weekly login to review the Security Posture Dashboard and any closed incident reports to maintain situational awareness.
2. For SIEM Platform Only Customers
Your Role: The Security Operator
With the SIEM Platform, your team is in full control of your security operations. The platform provides the tools and intelligence; you provide the analysis and response.
Primary Responsibility: Daily Alert Triage You must actively manage the security alerts generated by the platform. This can be done through two primary methods:
Method 1: Direct Console Login (Recommended)
Log into the ThreatDefence Security Dashboard daily.
Navigate to the “Security Detections” queue.
Triage Alerts: Review, investigate, and action each alert by:
Closing false positives.
Escalating true positives to your IT team for remediation.
Adding notes for audit trails.
Method 2: Email Alert Monitoring (Minimum Requirement)
Ensure email alerts are enabled for your security team.
Review all email notifications for new detections.
You must log into the console to fully investigate and close alerts. Email is for notification only.
Technical Requirement:
Daily interaction with the platform is required to maintain security efficacy.
Your team is responsible for the end-to-end process: Detection → Triage → Response → Closure.
Summary of Responsibilities
24/7 Monitoring
Handled by ThreatDefence SOC
Your Responsibility
Initial Alert Triage
Handled by ThreatDefence SOC
Your Responsibility
Respond to Escalations
Your Responsibility
Not Applicable
Daily Platform Login
Recommended (Awareness)
Required (Operation)
Email Alert Review
For escalations only
Minimum requirement for notifications
Getting Started Checklist
For Managed SOC Customers:
For SIEM Platform Only Customers:
Need Help? Our support team is here to assist with:
Technical configuration and onboarding.
Analyst training for the platform.
Defining escalation workflows.
Contact Support: [email protected]
This document ensures clarity of roles and responsibilities, setting both our teams up for a successful security partnership.
Last updated