02 National-scale SOC programme
A national-scale security operations mandate required a production SOC protecting critical infrastructure across multiple sectors — with no high-availability monitoring platform, no structured detection and response…
Managed Security Service Provider
Managed SOC monitoring and detection with CSIRT incident coordination under agreed SLAs — without building a full in-house operations stack first.
Telemetry stays in the client estate. Fidelir operates detection, 24/7 intake and CSIRT coordination — under the SLA agreed at onboarding.
Client estate
Telemetry sources
- Network
- Endpoint
- Identity
- Cloud
- Applications
- Intel
- IoT / OT
Fidelir operates
01
Onboarding
Scope, sources, use-cases, runbooks
02
SOC 24/7
Detection, soc@ intake, alerts, vuln support
03
CSIRT
RFC 2350 coordination, escalation, reporting
Documented SLA · runbooks · periodic reporting · multi-tenant
- Telemetry
- SOC alert
- CSIRT escalation
One multi-tenant stack: ingest, correlation, playbooks and cases. Modules (NDR, EDR, intel) are scoped per engagement — not every sensor on day one.
Scroll sideways for the full map.
What this covers
- SOC monitoring scope, SLAs and escalation to CSIRT
- Telemetry onboarding and detection use-cases
- 24/7 alert handling and vulnerability-management support
- CSIRT incident coordination and periodic service reporting
Typical outcomes
24/7 SOC intake and visibility; CSIRT coordination in duty hours with after-hours escalation; periodic performance and vulnerability status reporting.
When to engage
Organisations that need managed SOC operations and structured CSIRT coordination without building a full in-house stack immediately.
Engagement model
- Agree monitoring scope, SLAs and escalation paths between SOC and CSIRT.
- Onboard telemetry, detection use-cases and runbooks.
- Operate SOC monitoring, detection, alerting and vulnerability support.
- Coordinate incidents through CSIRT and report service performance.
Reference frameworks for this engagement:
Practitioner credentials for this engagement:
Cases
03 Critical national event — cyber defence
During the 2024 national electoral process, critical digital infrastructure faced sustained high-pressure threat activity — large-scale DDoS, social-engineering campaigns and real-time attacks against availability and…
04 National incident response platform
National incident reporting and investigation lacked a single structured platform — cases tracked inconsistently, forensic artefacts collected ad hoc and hand-offs between monitoring, hunting and response teams without…
Outline your environment and required SLA. We will propose a managed SOC + CSIRT operating model and onboarding plan.