Co-managed
Your analysts keep ownership of the SIEM and incident decisions, while our SOC covers nights, weekends and overflow. Shared runbooks keep handovers clean.
Cybersecurity · Defensive
SOC-as-a-Service: 24/7 monitoring, triage and incident response
Dark Pools runs a 24/7 Security Operations Center for your environment from operations centers in the United States and Southern Africa. Analysts triage alerts, investigate the ones that matter and coordinate containment with your team when an incident is confirmed. Run it co-managed alongside your own staff, or have Dark Pools carry the full watch.
Outcomes
What you get
- Alerts triaged by analysts around the clock, including nights, weekends and public holidays
- Confirmed incidents escalated with scope, evidence and recommended containment already assembled
- Containment actions agreed in advance, so response starts without waiting on approval chains
- One accountable team across monitoring, investigation and response instead of several vendors
- Detection coverage that improves as each investigation feeds new use cases back into the SIEM
How we engage
The engagement, step by step
- 01OnboardConnect log sources, endpoints and identity systems, and agree asset criticality, contacts and escalation paths.
- 02BaselineTune detections against normal activity in your environment so analysts work real signals rather than noise.
- 03Monitor & triageAnalysts watch the queue around the clock, enrich each alert and separate benign activity from suspicious behavior.
- 04InvestigateSuspicious activity is scoped across hosts, accounts and network flows and mapped to MITRE ATT&CK techniques.
- 05RespondContainment runs under pre-approved runbooks, such as isolating a host or disabling an account, with your team kept informed.
- 06Review & improveEach incident closes with a written report, and the lessons feed back into detection rules and runbooks.
Scope
What we cover
Fully managed
Dark Pools operates monitoring, triage, investigation and response end to end, and your team receives escalations and reports.
Telemetry covered
Endpoint, identity, network, email, cloud control-plane and application logs, depending on what your environment produces.
Incident response
Containment, eradication support and recovery coordination for confirmed incidents, with evidence preserved for later review.
Deliverables
What you receive
- 01Onboarding plan with a log-source inventory and known coverage gaps
- 02Escalation matrix and pre-approved response runbooks
- 03Incident reports with timeline, scope, root cause and remediation steps
- 04Detection coverage map against MITRE ATT&CK
- 05Regular service reviews covering alert trends, detection changes and open risks
FAQ
Questions buyers ask
In a co-managed model your internal team keeps day-to-day ownership, and our analysts extend coverage to nights, weekends and peak periods using shared runbooks. In a fully managed model Dark Pools runs the watch end to end and escalates confirmed incidents to your named contacts.
Monitoring runs from operations centers in the United States and Southern Africa, which gives round-the-clock coverage across time zones. Data-residency requirements are agreed during onboarding.
No. The SOC works from the SIEM and security tools you already run, provided they produce the telemetry analysts need. Coverage gaps are documented during onboarding along with what it would take to close them.
Yes, within limits you set. During onboarding we agree which actions analysts may take on their own, such as isolating an endpoint or disabling a compromised account, and which need your approval first.
Get started
Take the next step
Scope soc-as-a-service with a security lead. We will tell you plainly what you need, and what you do not.