Security Operations Center (SOC) in Dubai
Our SOC watches your Microsoft 365, Entra ID, Defender and Azure activity through Microsoft Sentinel, in a workspace that sits in your own Azure subscription. P1 incidents are answered within 5 minutes at any hour, P2 and P3 alerts within 10 and 30 minutes in business hours, and every month you get a written report of what we saw and what we did.
- 50+Sentinel tenants
- 24/7P1 incident cover
- 5 minP1 response
- YoursWorkspace and logs
Six jobs our SOC does for you, every day.
Alert monitoring and triage
Every Sentinel and Defender alert is looked at by an analyst, not just logged. False positives are closed with a reason and real ones are investigated. P1 alerts are covered at any hour, P2 and P3 in business hours.
Investigation
For each real alert we work out what happened, which users, devices and mailboxes are involved, and how far it got, using the sign-in, device and email history already in your workspace.
Containment you approved in advance
Disabling an account, revoking its sessions, isolating a device or removing a phishing email from every mailbox. You approve the list of actions at onboarding, so we can act on a P1 without waiting for a meeting.
Detection tuning
Analytics rules are tuned to how your business actually works, so an alert means something. New rules are added when a gap shows up, and noisy ones are fixed rather than ignored.
Threat hunting
Analysts search your logs for activity no rule has flagged yet, such as unusual inbox rules, consent grants to unknown apps or sign-ins from new countries. What they find becomes a new rule or an incident.
Monthly reporting
A written report every month: alerts and incidents, what we did about each, response times against P1, P2 and P3, rules added or changed, and what we recommend you fix next.
Four things you can check before you sign.
Sentinel in more than 50 tenants
Microsoft Sentinel is the platform we work in every day. Your workspace starts from connectors, rules and playbooks we already run, then gets tuned to your environment.
Your workspace, your logs
Sentinel is deployed in your Azure subscription and we work in it through delegated access. If you leave, you remove our access and keep the workspace, the logs, the rules and the playbooks.
Response times in writing
P1 within 5 minutes, any hour of any day. P2 within 10 minutes and P3 within 30 minutes in business hours. Every monthly report shows how we did against them.
We can fix what we find
We also manage Microsoft 365, Entra ID, Intune and Defender. When an alert traces back to a weak setting, we can change it with your approval instead of handing you a ticket.
Which systems does the SOC watch?
| Source | What we watch for | How it reaches Sentinel |
|---|---|---|
| Microsoft Entra ID | Risky and unusual sign-ins, MFA changes, new admin role assignments, app consent grants | Microsoft Entra ID data connector |
| Microsoft 365 (Exchange, SharePoint, Teams) | Suspicious inbox rules, mailbox forwarding, mass downloads, external sharing | Microsoft 365 data connector |
| Defender for Endpoint and Defender for Office 365 | Malware, ransomware behaviour, phishing clicks, malicious attachments | Microsoft Defender XDR data connector |
| Azure subscriptions | Changes to resources, roles, network rules and key vaults | Azure Activity data connector |
| Firewalls and network devices | Unusual traffic, VPN sign-ins, admin changes | Syslog or CEF through a log collector |
| Windows and Linux servers | Security events, privilege use, new services and scheduled tasks | Azure Monitor Agent |
Six situations where a SOC service makes more sense than hiring.
No security team yet
Too small to staff security shifts, too exposed to leave alerts in an IT inbox that nobody reads at night.
An IT team, but no security analysts
Your team keeps running IT. We take the alert queue, the investigation and the containment, and call them when a decision is theirs.
Regulated businesses
Firms that answer to auditors or a regulator need a record of what was detected, when, and what was done about it.
Multi-branch businesses
Many sites, devices and accounts, watched from one workspace instead of one firewall console at a time.
Cyber insurance renewals
Insurance questionnaires often ask who monitors security alerts and how quickly incidents are handled. A SOC service gives you a written answer.
After an incident
If you have just recovered from a compromise, monitoring means the next attempt is seen early instead of being discovered weeks later.
Our SOC, your own SOC, or no SOC?
| Feature | GR SOC as a service | Build your own SOC | No SOC (alerts go to IT) |
|---|---|---|---|
P1 incidents covered at night and weekends | Needs shift staff | ||
P1 response time | 5 minutes, in writing | Depends on staffing | When someone notices |
P2 and P3 alerts | 10 and 30 minutes, business hours | Depends on staffing | When someone has time |
Rules tuned to your environment | Needs a detection engineer | ||
Threat hunting | Needs senior analysts | ||
Workspace and logs in your tenant | |||
Monthly written report | If someone writes it | ||
What you pay for | Yearly service fee, plus Azure usage | Salaries, tools and training | The cost of the incident |
How fast do you respond, and when?
| Priority | Response | Covered | Typical examples |
|---|---|---|---|
| P1, critical | Within 5 minutes | Any hour, any day | Ransomware running, an admin account taken over, mass email sent from your domain |
| P2, high | Within 10 minutes | Business hours | One user account compromised, malware blocked on a device, suspicious mailbox forwarding |
| P3, normal | Within 30 minutes | Business hours | An unusual sign-in to check, a policy change to review, a noisy rule to tune |
Who does what when an alert fires?
| Task | GR SOC | Your team |
|---|---|---|
| Watch and triage alerts | Does it | Gets the P1 call and the monthly report |
| Investigate | Does it and shares what we find | Answers questions about users, devices and business activity |
| Contain (disable an account, isolate a device, remove an email) | Does it, within the actions you approved | Approves the action list at onboarding and decides anything outside it |
| Change security settings | Recommends, and makes the change once approved | Approves the change |
| Recover systems and data | Advises, and can help through our incident response service | Decides and owns recovery |
| Tell regulators, insurers or customers | Provides the timeline and evidence | Decides and submits |
| Pay for Sentinel usage | Sizes it and keeps noisy sources in check | Billed by Microsoft through your Azure subscription |
What your monthly SOC report covers.
What happened
- Alerts received and how each was closedFalse positive, harmless, or a real incident, with the reason.
- Incidents, and what we did about eachTimeline, accounts and devices involved, actions taken.
- Response times against P1, P2 and P3Including any we missed, and why.
What to do next
- Rules added or tuned this monthSo you can see coverage growing, not standing still.
- Log sources that went quietA connector that stops sending is a blind spot until someone notices.
- Recommended fixes, in priority orderSettings, licences or habits that would have prevented this month's alerts.
From scoping call to live monitoring in four steps.
- 1
Scoping call
We list your log sources, users and devices, agree who we call for a P1, and agree which containment actions we may take without asking first.
- 2
Workspace and connectors
Sentinel is set up in your Azure subscription, or we take over the workspace you already have. Data connectors and retention are configured, and log volumes are sized before costs build up.
- 3
Tuning
Rules are switched on and tuned against your normal activity, false positives are cut back, and response playbooks are agreed with your team.
- 4
Live monitoring
Response times apply from go-live. Your first monthly report arrives at the end of the first full month.
What buyers ask before they sign.
Tell us what you need watched, and we will scope your SOC.
Bring a rough list of your systems, how many users and devices you have, and who should get the call at 3am for a P1. We will confirm the sources, response times and responsibilities in writing.
Related Services
Explore more solutions that work great with this service
Managed Security Services
MSS on Microsoft Defender XDR and Sentinel
Microsoft Sentinel
Cloud-native SIEM and threat intelligence
Incident Response
24/7 incident response and forensics in Dubai
Defender XDR
Eleven signal sources, one incident, and containment without a human
Network Monitoring NOC
Network monitoring with alerting
KQL Threat Hunting
Hunting across Defender data, and turning it into detections
Sentinel SOC Optimization
Coverage gaps and ingestion you are not using
Co-Managed IT
Augment your internal IT team with co-managed services