SOC Service Catalogue

The SOC service catalogue makes the SOC’s deliverables explicit, its scope boundaries clear, and its operational commitments measurable against the SLA framework. Without this definitional clarity, the SOC’s value remains perceived rather than demonstrated, its scope negotiated rather than governed, and its improvement directed by operational instinct rather than structured service quality management.

The catalogue encompasses the core services forming the foundational security operations capability, the supplementary services extending the SOC’s governance influence into adjacent security domains, and for the global SOC model, the managed security service components whose client-facing delivery the service portfolio must sustain across the full client lifecycle.

Core Services #

Threat Monitoring and Detection #

Threat Monitoring and Detection is the SOC’s most fundamental operational commitment, providing the continuous identification and analysis of security events across the full technology estate. It is the operational expression of the SOC’s primary purpose: maintaining the organisational visibility that prevents the adversary from operating undetected.

The service aggregates logs and security events from the diverse technology sources whose combined telemetry creates the environmental awareness no single source can provide. Network traffic analysis, endpoint behavioural telemetry, application security events, identity management logs, cloud service audit trails, and operational technology monitoring together constitute the log source portfolio the detection coverage requires.

Correlation and anomaly detection applies rules, machine learning models, and behavioural baselines to distinguish malicious activity from operational noise. A correlation rule connecting a failed authentication sequence to a subsequent privilege escalation and lateral movement creates detection capability that isolated event assessment alone cannot produce.

Alert triage determines the legitimacy and priority of each alert, evaluating it against current threat intelligence, asset criticality, and detection context to produce the priority classification that accurate response resource deployment requires.