{"id":36622,"date":"2026-10-16T18:40:44","date_gmt":"2026-10-16T16:40:44","guid":{"rendered":"https:\/\/sits.com\/?p=36622"},"modified":"2026-10-16T18:40:45","modified_gmt":"2026-10-16T16:40:45","slug":"what-is-a-managed-soc","status":"publish","type":"post","link":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/","title":{"rendered":"What is a Managed SOC?"},"content":{"rendered":"<section class=\"wpb-content-wrapper\"><p>[vc_row][vc_column]<h2  class=\"h2 smx-headline \">What does SOC (Security Operations Center) mean?<\/h2>[vc_column_text]A <strong>Security Operations Center <\/strong>is the function responsible for detecting, investigating and handling security incidents within an organization. Despite the name, a SOC is less about a physical room full of screens and more about a security capability built from three parts:<\/p>\n<ul>\n<li><strong>Data:<\/strong> Logs and alerts from your systems, such as sign-ins, endpoints, firewalls, cloud services and email.<\/li>\n<li><strong>Detection logic:<\/strong> Rules and models that determine which activity may look suspicious.<\/li>\n<li><strong>People and processes:<\/strong> Analysts who investigate, plus a defined workflow for what happens once they find a potential threat.<\/li>\n<\/ul>\n<p>Each component depends on the others: Security data provides visibility into activity across the environment. Detection logic turns this data into meaningful alerts, while analysts assess the context and determine whether action is required.[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-up\"][vc_column]<h2  class=\"h2 smx-headline \">What is a Managed SOC?<\/h2>[vc_column_text]<a href=\"https:\/\/sits.com\/en\/blog\/managed-soc-services-guide\/\">A managed SOC<\/a> delivers the capabilities of a <a href=\"https:\/\/sits.com\/en\/cyber-defense-center\/security-operations-center\/\">Security Operations Center<\/a>\u00a0as an external service. Your organization connects agreed data sources to a provider, whose analysts monitor and investigate security activity on your behalf. Depending on the contracted service, this monitoring may take place during defined business hours or around the clock.<\/p>\n<p>The difference between an internal and a managed SOC is primarily <strong>who operates it<\/strong>, not what it does. In an internal SOC, you employ the analysts, build the detections, manage shift schedules and maintain the tooling. With a managed SOC, the provider takes responsibility for this operational work and delivers confirmed incidents together with clear recommendations.<\/p>\n<p>\u201cManaged\u201d can also describe different service models:<\/p>\n<ul>\n<li>In a <strong>fully managed<\/strong> <strong>SOC<\/strong>, the provider handles detection and investigation end to end.<\/li>\n<li>In a <strong>co-managed<\/strong> <strong>SOC<\/strong>, the work is split between the provider and your internal security team.<\/li>\n<\/ul>\n<p>The appropriate model depends on your internal resources, existing capabilities and desired level of control<\/p>\n<p>You may also encounter the term <a href=\"https:\/\/sits.com\/en\/cyber-defense-center\/security-operations-center\/\">SOC-as-a-Service<\/a>. It is largely interchangeable with managed SOC. Instead of choosing based on terminology alone, compare providers according to the scope, responsibilities and service levels defined in their contracts.[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n<h2  class=\"h2 smx-headline \">What does a Managed SOC team do?<\/h2>[vc_column_text]<\/p>\n<p class=\"FirstParagraph\"><span lang=\"EN-US\">A managed SOC analyzes alerts in stages. Every alert receives an initial assessment, while only those that cannot be resolved at an early stage move on to deeper investigation. This allows analysts to focus their time and expertise on the cases that genuinely require attention.<\/span><\/p>\n<p>[\/vc_column_text][\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-down\"][vc_column][vc_raw_html]JTNDc3R5bGUlM0UlMjAlMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMCU3QiUwQSUyMCUyMCUyMCUyMGJvcmRlci1jb2xsYXBzZSUzQSUyMGNvbGxhcHNlJTNCJTBBJTIwJTIwJTIwJTIwd2lkdGglM0ElMjAxMDAlMjUlM0IlMEElMjAlMjAlMjAlMjBmb250LWZhbWlseSUzQSUyMHNhbnMtc2VyaWYlM0IlMEElMjAlMjAlN0QlMEElMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMHRoJTJDJTBBJTIwJTIwdGFibGUudGhyZWF0LWluZm8tdGFibGUlMjB0ZCUyMCU3QiUwQSUyMCUyMCUyMCUyMGJvcmRlciUzQSUyMDJweCUyMHNvbGlkJTIwJTIzZmZmZmZmMzMlM0IlMEElMjAlMjAlMjAlMjBwYWRkaW5nJTNBJTIwMjBweCUzQiUwQSUyMCUyMCUyMCUyMGNvbG9yJTNBJTIwJTIzZmZmZmZmJTNCJTBBJTIwJTIwJTIwJTIwdmVydGljYWwtYWxpZ24lM0ElMjB0b3AlM0IlMEElMjAlMjAlN0QlMEElMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMHRoZWFkJTIwdGglMjAlN0IlMEElMjAlMjAlMjAlMjBiYWNrZ3JvdW5kLWNvbG9yJTNBJTIwJTIzZGVkYzAwJTNCJTBBJTIwJTIwJTIwJTIwY29sb3IlM0ElMjAlMjMwMDAwMDAlM0IlMEElMjAlMjAlMjAlMjBmb250LXdlaWdodCUzQSUyMGJvbGQlM0IlMEElMjAlMjAlMjAlMjB0ZXh0LWFsaWduJTNBJTIwbGVmdCUzQiUwQSUyMCUyMCU3RCUwQSUwQSUyMCUyMHRhYmxlLnRocmVhdC1pbmZvLXRhYmxlJTIwdGJvZHklMjB0ZCUyMCU3QiUwQSUyMCUyMCUyMCUyMGJhY2tncm91bmQtY29sb3IlM0ElMjAlMjMwYzJmNDglM0IlMEElMjAlMjAlN0QlMEElM0MlMkZzdHlsZSUzRSUwQSUwQSUzQ3RhYmxlJTIwY2xhc3MlM0QlMjJ0aHJlYXQtaW5mby10YWJsZSUyMiUzRSUwQSUyMCUyMCUzQ3RoZWFkJTNFJTBBJTIwJTIwJTIwJTIwJTNDdHIlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0aCUzRVN0ZXAlM0MlMkZ0aCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RoJTNFV2hhdCUyMGhhcHBlbnMlM0MlMkZ0aCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RoJTNFVHlwaWNhbCUyMG91dGNvbWUlM0MlMkZ0aCUzRSUwQSUyMCUyMCUyMCUyMCUzQyUyRnRyJTNFJTBBJTIwJTIwJTNDJTJGdGhlYWQlM0UlMEElMjAlMjAlM0N0Ym9keSUzRSUwQSUyMCUyMCUyMCUyMCUzQ3RyJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VNb25pdG9yaW5nJTIwYW5kJTIwZGV0ZWN0aW9uJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVRlbGVtZXRyeSUyMGZyb20lMjB0aGUlMjBTSUVNJTIwYW5kJTIwRURSJTJGWERSJTIwcGxhdGZvcm1zJTIwaXMlMjB3YXRjaGVkJTIwY29udGludW91c2x5JTJDJTIwYW5kJTIwZGV0ZWN0aW9uJTIwcnVsZXMlMjByYWlzZSUyMGFsZXJ0cy4lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFQW4lMjBhbGVydCUyMGVudGVycyUyMHRoZSUyMHF1ZXVlLiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFQWxlcnQlMjBUcmlhZ2UlM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFQWxlcnRzJTIwYXJlJTIwcHJpb3JpdGl6ZWQlMjBhcyUyMHRoZXklMjBhcnJpdmUuJTIwTWFueSUyMHByb3ZpZGVycyUyMHVzZSUyMGF1dG9tYXRpb24lMjBvciUyMEFJLWFzc2lzdGVkJTIwd29ya2Zsb3dzJTIwdG8lMjByZWNvZ25pemUlMjBrbm93biUyMHBhdHRlcm5zJTIwYW5kJTIwY2xlYXIlMjByZXBldGl0aXZlJTIwYWxlcnRzJTJDJTIwc28lMjBhbmFseXN0cyUyMGNhbiUyMGZvY3VzJTIwb24lMjB0aGUlMjByZXN0LiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VSb3V0aW5lJTIwYWxlcnRzJTIwYXJlJTIwY2xlYXJlZCUyQyUyMHdoaWxlJTIwdGhlJTIwcmVzdCUyMGFyZSUyMHF1ZXVlZCUyMGJ5JTIwcHJpb3JpdHkuJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUyMCUyMCUzQ3RyJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VBbmFseXN0JTIwaW52ZXN0aWdhdGlvbiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VBbiUyMGFuYWx5c3QlMjByZXZpZXdzJTIwdGhlJTIwYXJ0ZWZhY3RzJTIwYW5kJTIwaW5kaWNhdG9ycyUyMG9mJTIwY29tcHJvbWlzZSUyMCUyOElvQ3MlMjklMkMlMjBzdWNoJTIwYXMlMjBJUCUyMGFkZHJlc3NlcyUyQyUyMHVzZXJuYW1lcyUyQyUyMFVSTHMlMkMlMjBmaWxlJTIwaGFzaGVzJTIwYW5kJTIwd2hhdCUyMHRoZSUyMHNlY3VyaXR5JTIwdG9vbCUyMGRpZCUyQyUyMGFuZCUyMGVzdGFibGlzaGVzJTIwdGhlJTIwc2VxdWVuY2UlMjBvZiUyMGV2ZW50cy4lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFTW9zdCUyMGluY2lkZW50cyUyMGFyZSUyMHN0cmFpZ2h0Zm9yd2FyZCUyMGFuZCUyMGNsb3NlZCUyMHdpdGhpbiUyMG1pbnV0ZXMuJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUyMCUyMCUzQ3RyJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VFeHRlbmRlZCUyMGludmVzdGlnYXRpb24lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFRm9yJTIwYW1iaWd1b3VzJTIwY2FzZXMlMkMlMjB0aGUlMjBhbmFseXN0JTIwd2lkZW5zJTIwdGhlJTIwdmlldyUyMGFyb3VuZCUyMHRoZSUyMGV2ZW50LiUyMFRoaXMlMjBtZWFucyUyMGNvcnJlbGF0aW5nJTIwYWN0aXZpdHklMjBiZWZvcmUlMjBhbmQlMjBhZnRlciUyMGl0JTJDJTIwYW5kJTIwY2hlY2tpbmclMjB3aGV0aGVyJTIwdGhlJTIwc2FtZSUyMGJlaGF2aW9yJTIwYXBwZWFycyUyMGVsc2V3aGVyZS4lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFVGhlJTIwc2NvcGUlMjBvZiUyMGElMjByZWFsJTIwaW5jaWRlbnQlMjBpcyUyMHVuZGVyc3Rvb2QuJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUyMCUyMCUzQ3RyJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VUaHJlYXQlMjBpbnRlbGxpZ2VuY2UlMjBlbnJpY2htZW50JTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRUV4dGVybmFsJTIwY29udGV4dCUyMGlzJTIwYWRkZWQlMjBhYm91dCUyMHRoZSUyMGFjdG9yJTJDJTIwdG9vbGluZyUyMG9yJTIwaW5mcmFzdHJ1Y3R1cmUlMjBpbnZvbHZlZC4lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFU2V2ZXJpdHklMjBpcyUyMGp1ZGdlZCUyMG9uJTIwZXZpZGVuY2UuJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUyMCUyMCUzQ3RyJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VFc2NhbGF0aW9uJTIwdG8lMjB0aGUlMjBjdXN0b21lciUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VDb25maXJtZWQlMjBpbmNpZGVudHMlMjBnbyUyMHRvJTIweW91ciUyMHRpY2tldCUyMHN5c3RlbSUyMG9yJTIwZW1haWwlMjBkaXN0cmlidXRpb24lMjBsaXN0LiUyMENyaXRpY2FsJTIwaW5jaWRlbnRzJTIwYXJlJTIwYWxzbyUyMHBob25lZCUyMHRocm91Z2guJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVlvdXIlMjB0ZWFtJTIwa25vd3MlMjB3aGF0JTIwaGFwcGVuZWQlMjBhbmQlMjB3aGF0JTIwdG8lMjBkby4lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUzQyUyRnRyJTNFJTBBJTIwJTIwJTIwJTIwJTNDdHIlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVJlc3BvbnNlJTIwc3VwcG9ydCUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VJZiUyMHRoZSUyMHByb3ZpZGVyJTIwaGFzJTIwYmVlbiUyMGdyYW50ZWQlMjBhY3RpdmUlMjByZXNwb25zZSUyMHJpZ2h0cyUyQyUyMHRoZSUyMFNPQyUyMGNhcnJpZXMlMjBvdXQlMjBhZ3JlZWQlMjBjb250YWlubWVudCUyMGFjdGlvbnMuJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVRoZSUyMHRocmVhdCUyMGlzJTIwY29udGFpbmVkJTIwYmVmb3JlJTIweW91ciUyMHRlYW0lMjBzdGFydHMlMjB3b3JrLiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFSW5jaWRlbnQlMjBSZXNwb25zZSUyMGhhbmQtb2ZmJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRUlmJTIwYW4lMjBpbmNpZGVudCUyMGRldmVsb3BzJTIwaW50byUyMGElMjBjb25maXJtZWQlMjBjb21wcm9taXNlJTJDJTIwYSUyMGRlZGljYXRlZCUyMEluY2lkZW50JTIwUmVzcG9uc2UlMjAlMjhJUiUyOSUyMHRlYW0lMjB0YWtlcyUyMG92ZXIlMjBjb250YWlubWVudCUyQyUyMGZvcmVuc2ljcyUyMGFuZCUyMHJlY292ZXJ5LiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VBJTIwY29vcmRpbmF0ZWQlMjByZXNwb25zZSUyMGFuZCUyMHJlY292ZXJ5JTIwcHJvY2VzcyUyMGJlZ2lucy4lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUzQyUyRnRyJTNFJTBBJTIwJTIwJTNDJTJGdGJvZHklM0UlMEElM0MlMkZ0YWJsZSUzRQ==[\/vc_raw_html][vc_column_text]Every confirmed incident is documented with a timeline of events and specific recommendations. That record supports regular reporting and continuous improvement of detection logic.[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]<h2  class=\"h2 smx-headline \">Managed SOC Use Cases: Real Threat Detection and Response Scenarios<\/h2><h3  class=\"h3 smx-headline \">Example 1: Suspicious sign-in detected by the SIEM<\/h3>[vc_column_text]Late one evening, <a href=\"https:\/\/sits.com\/en\/cyber-defense-center\/siem\/\">the SIEM<\/a> (Security Information and Event Management) raises an impossible-travel alert. A finance employee signed in from the office network, then from another continent 30 minutes later.<\/p>\n<p><strong>Triage:<\/strong> The alert doesn\u2019t match known benign patterns, such as the company VPN or a registered travel pattern. It is therefore passed to an analyst.<\/p>\n<p><strong>Investigation:<\/strong> The analyst establishes that the second sign-in came from a previously unknown device and that the multi-factor authentication prompt was approved.<\/p>\n<p><strong>Extended investigation:<\/strong> The analyst reviews the activity that followed the sign-in. A few minutes later, a new inbox rule began forwarding emails containing the word \u201cinvoice\u201d to an external address. The analyst also checks whether other accounts have signed in from the same IP address.<\/p>\n<p><strong>Enrichment<\/strong><strong>:<\/strong> <a href=\"https:\/\/sits.com\/en\/cyber-defense-center\/cyber-threat-intelligence\/\">Threat intelligence<\/a>\u00a0links the IP address to infrastructure previously associated with business email compromise campaigns.<\/p>\n<p><strong>Escalation:<\/strong> Because the incident involves unauthorized access to data, it is classified as critical. The on-call contact is notified by phone, and the incident is recorded in the ticketing system together with the recommended next steps.<\/p>\n<p><strong>Response:<\/strong> If the SOC has active response rights, it revokes the user\u2019s sessions and resets the password straight away. If not, these actions are included as the first recommendations for the customer\u2019s team.<\/p>\n<p>The internal team then continues with the necessary remediation:<\/p>\n<ol>\n<li>Confirm the situation with the employee.<\/li>\n<li>Remove the forwarding rule.<\/li>\n<li>Check whether data has left the mailbox.<\/li>\n<li>Decide on wider action, such as warning suppliers or customers who may receive fraudulent invoices.<\/li>\n<\/ol>\n<p>[\/vc_column_text]<h3  class=\"h3 smx-headline \">Example 2: Active response to a compromised employee device<\/h3>[vc_column_text]In a standard setup, the SOC detects and recommends, and your team acts. The time between notification and action is often the weakest point, especially during nights, weekends or public holidays. Active response closes that gap by allowing SOC analysts to perform predefined containment actions themselves. This usually works through API access to your <a href=\"https:\/\/sits.com\/en\/cyber-defense-center\/mxdr\/\">EDR\/XDR<\/a>, SIEM or identity platform.<\/p>\n<p>At 03:10 on a Saturday, the EDR\/XDR platform flags a sales employee's laptop. A file downloaded as a \"browser update\" is reading saved browser passwords and connecting to an unknown external domain.<\/p>\n<p><strong>Triage:<\/strong> The behavior closely matches known infostealer malware techniques, which are designed to harvest credentials and session data. The alert is immediately prioritized as high severity and assigned to an analyst.<\/p>\n<p><strong>Investigation:<\/strong> The analyst confirms that the file is malicious and not a legitimate software update. Evidence shows that it accessed the browser's credential store and transmitted data to the external domain.<\/p>\n<p><strong>Enrichment:<\/strong> Threat intelligence identifies the domain as command-and-control infrastructure associated with a known infostealer family, confirming the likelihood of credential theft.<\/p>\n<p><strong>Extended investigation:<\/strong> The analyst searches for the same file hash and domain across the environment. A second laptop is found to have downloaded the same file, although the malware was never executed on that system.<\/p>\n<p><strong>Containment:<\/strong> The organization has agreed these actions in advance, so the SOC acts straight away:<\/p>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\n<li>Isolates the infected laptop from the network<\/li>\n<li>Stops the malicious process<\/li>\n<li>Blocks the file hash and the domain across the environment<\/li>\n<li>Revokes the employee's active sessions and resets their password<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<p><strong>Escalation:<\/strong> The incident is classified as critical. The on-call contact is phoned and the incident is recorded in the ticketing system with the actions already taken and the recommended next steps.<\/p>\n<p>By the time the internal team starts work on Saturday morning, the immediate threat has already been contained. The team can therefore focus on remediation and recovery activities, including:<\/p>\n<ul>\n<li>Reimaging the compromised laptop<\/li>\n<li>Find out which credentials were stored in the browser and change them, including credentials for SaaS and third-party platforms<\/li>\n<li>Remove the unexecuted file from the second laptop<\/li>\n<li>Decide on wider action, such as warning other employees about the fake browser update<\/li>\n<\/ul>\n<p><strong>Without active response,<\/strong> the detection and escalation process would have been identical. The difference is that the compromised laptop would have remained connected to the network and the stolen credentials would have remained valid until someone was available to respond. At 03:10 on a Saturday, that delay could easily last several hours.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>What makes active response work:<\/strong><\/p>\n<ul>\n<li><strong>Permissions:<\/strong> Organizations define which access rights and credentials the provider receives. Actions can only be performed where the connected security platforms technically support them.<\/li>\n<li><strong>Agreements made upfront:<\/strong> These agreements define which actions the SOC may perform immediately, which require customer approval and who must be informed after actions have been taken.<\/li>\n<li><strong>Clear limits:<\/strong> Active response is designed to contain a threat, not to complete the entire recovery process. It does not rebuild systems, restore data, apply patches or make business decisions about the wider response. Those stay with your team. Incidents that need more than containment move to <a href=\"https:\/\/sits.com\/en\/cyber-defense-center\/csirt\/\">Incident Response<\/a>.<\/li>\n<\/ul>\n<p><strong>Who does what<\/strong><\/p>\n<p><strong>The provider:<\/strong> detect, investigate, prioritize, notify and recommend. With active response, it also carries out agreed containment actions.<\/p>\n<p><strong>You:<\/strong> keep data sources connected and contact details current, provide business context, carry out full remediation and recovery, manage any permissions you grant and own the risk decisions.<\/p>\n<p>Clearly defined responsibilities and escalation workflows are essential for ensuring that incidents move quickly from detection to resolution. This becomes particularly important when multiple teams are involved and incidents need to be handed over between operational monitoring, remediation and recovery processes as part of broader incident escalation workflows in managed SOC services.[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]<h2  class=\"h2 smx-headline \">What technologies does a Managed SOC use?<\/h2>[vc_column_text]The value of a managed SOC does not depend on a single product. What matters is how effectively the tools are connected, configured and tuned. Nevertheless, understanding the role of each technology helps organizations evaluate the <a href=\"https:\/\/sits.com\/en\/blog\/digital-resilience-starts-with-security-by-design\/\">scope of a managed service<\/a>.[\/vc_column_text][vc_raw_html]JTNDc3R5bGUlM0UlMjAlMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMCU3QiUwQSUyMCUyMCUyMCUyMGJvcmRlci1jb2xsYXBzZSUzQSUyMGNvbGxhcHNlJTNCJTBBJTIwJTIwJTIwJTIwd2lkdGglM0ElMjAxMDAlMjUlM0IlMEElMjAlMjAlMjAlMjBmb250LWZhbWlseSUzQSUyMHNhbnMtc2VyaWYlM0IlMEElMjAlMjAlN0QlMEElMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMHRoJTJDJTBBJTIwJTIwdGFibGUudGhyZWF0LWluZm8tdGFibGUlMjB0ZCUyMCU3QiUwQSUyMCUyMCUyMCUyMGJvcmRlciUzQSUyMDJweCUyMHNvbGlkJTIwJTIzZmZmZmZmMzMlM0IlMEElMjAlMjAlMjAlMjBwYWRkaW5nJTNBJTIwMjBweCUzQiUwQSUyMCUyMCUyMCUyMGNvbG9yJTNBJTIwJTIzZmZmZmZmJTNCJTBBJTIwJTIwJTIwJTIwdmVydGljYWwtYWxpZ24lM0ElMjB0b3AlM0IlMEElMjAlMjAlN0QlMEElMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMHRoZWFkJTIwdGglMjAlN0IlMEElMjAlMjAlMjAlMjBiYWNrZ3JvdW5kLWNvbG9yJTNBJTIwJTIzZGVkYzAwJTNCJTBBJTIwJTIwJTIwJTIwY29sb3IlM0ElMjAlMjMwMDAwMDAlM0IlMEElMjAlMjAlMjAlMjBmb250LXdlaWdodCUzQSUyMGJvbGQlM0IlMEElMjAlMjAlMjAlMjB0ZXh0LWFsaWduJTNBJTIwbGVmdCUzQiUwQSUyMCUyMCU3RCUwQSUwQSUyMCUyMHRhYmxlLnRocmVhdC1pbmZvLXRhYmxlJTIwdGJvZHklMjB0ZCUyMCU3QiUwQSUyMCUyMCUyMCUyMGJhY2tncm91bmQtY29sb3IlM0ElMjAlMjMwYzJmNDglM0IlMEElMjAlMjAlN0QlMEElM0MlMkZzdHlsZSUzRSUwQSUwQSUzQ3RhYmxlJTIwY2xhc3MlM0QlMjJ0aHJlYXQtaW5mby10YWJsZSUyMiUzRSUwQSUyMCUyMCUzQ3RoZWFkJTNFJTBBJTIwJTIwJTIwJTIwJTNDdHIlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0aCUzRVRlY2hub2xvZ3klM0MlMkZ0aCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RoJTNFV2hhdCUyMGl0JTIwZG9lcyUzQyUyRnRoJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGglM0VXaHklMjBhJTIwU09DJTIwbmVlZHMlMjBpdCUzQyUyRnRoJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlM0MlMkZ0aGVhZCUzRSUwQSUyMCUyMCUzQ3Rib2R5JTNFJTBBJTIwJTIwJTIwJTIwJTNDdHIlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVNJRU0lMjAlMjhTZWN1cml0eSUyMEluZm9ybWF0aW9uJTIwYW5kJTIwRXZlbnQlMjBNYW5hZ2VtZW50JTI5JTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRUNvbGxlY3RzJTIwYW5kJTIwY29ycmVsYXRlcyUyMGxvZ3MlMjBmcm9tJTIwYWNyb3NzJTIwdGhlJTIwb3JnYW5pemF0aW9uJUUyJTgwJTk5cyUyMGVudmlyb25tZW50LiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VDb25uZWN0cyUyMGV2ZW50cyUyMHRoYXQlMjBsb29rJTIwaGFybWxlc3MlMjB3aGVuJTIwdmlld2VkJTIwaW5kaXZpZHVhbGx5LiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFRURSJTIwJTI4RW5kcG9pbnQlMjBEZXRlY3Rpb24lMjBhbmQlMjBSZXNwb25zZSUyOSUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VNb25pdG9ycyUyMGFjdGl2aXR5JTIwb24lMjBsYXB0b3BzJTIwYW5kJTIwc2VydmVycyUyMGFuZCUyMGNhbiUyMHN1cHBvcnQlMjBhY3Rpb25zJTIwc3VjaCUyMGFzJTIwaXNvbGF0aW5nJTIwYWZmZWN0ZWQlMjBkZXZpY2VzLiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VNb3N0JTIwYXR0YWNrcyUyMHRvdWNoJTIwYW4lMjBlbmRwb2ludCUyMGF0JTIwc29tZSUyMHBvaW50LiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFWERSJTIwJTI4RXh0ZW5kZWQlMjBEZXRlY3Rpb24lMjBhbmQlMjBSZXNwb25zZSUyOSUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VFeHRlbmRzJTIwRURSLXN0eWxlJTIwZGV0ZWN0aW9uJTIwYWNyb3NzJTIwZW5kcG9pbnQlMkMlMjBpZGVudGl0eSUyQyUyMGVtYWlsJTIwYW5kJTIwY2xvdWQuJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVByb3ZpZGVzJTIwYSUyMGNvbm5lY3RlZCUyMHZpZXclMjBhY3Jvc3MlMjBtdWx0aXBsZSUyMGF0dGFjayUyMHN1cmZhY2VzLiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFU09BUiUyMCUyOFNlY3VyaXR5JTIwT3JjaGVzdHJhdGlvbiUyQyUyMEF1dG9tYXRpb24lMjBhbmQlMjBSZXNwb25zZSUyOSUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VBdXRvbWF0ZXMlMjByZXBldGl0aXZlJTIwc3RlcHMlMjBhbmQlMjByb3V0ZXMlMjBpbmNpZGVudHMuJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVNwZWVkcyUyMHVwJTIwdHJpYWdlJTIwYW5kJTIwYW5kJTIwc3VwcG9ydHMlMjBjb25zaXN0ZW50JTIwaGFuZGxpbmclMjBvZiUyMGFsZXJ0cy4lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUzQyUyRnRyJTNFJTBBJTIwJTIwJTIwJTIwJTNDdHIlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRUNsb3VkJTIwc2VjdXJpdHklMjB0b29scyUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VNb25pdG9yJTIwY2xvdWQlMjBwbGF0Zm9ybXMlMjBhbmQlMjBTYWFTJTIwYXBwbGljYXRpb25zJTJDJTIwc3VjaCUyMGFzJTIwTWljcm9zb2Z0JTIwMzY1JTJDJTIwQXp1cmUlMjBvciUyMEFXUy4lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFQ3JpdGljYWwlMjBidXNpbmVzcyUyMGFjdGl2aXR5JTIwaW5jcmVhc2luZ2x5JTIwdGFrZXMlMjBwbGFjZSUyMG91dHNpZGUlMjB0aGUlMjB0cmFkaXRpb25hbCUyMGNvcnBvcmF0ZSUyMG5ldHdvcmsuJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUyMCUyMCUzQ3RyJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VUaHJlYXQlMjBpbnRlbGxpZ2VuY2UlMjBwbGF0Zm9ybXMlM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFUHJvdmlkZSUyMGNvbnRleHQlMjBvbiUyMGtub3duJTIwYXR0YWNrZXJzJTJDJTIwdG9vbHMlMjBhbmQlMjBtYWxpY2lvdXMlMjBpbmZyYXN0cnVjdHVyZS4lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFSGVscCUyMGFuYWx5c3RzJTIwYXNzZXNzJTIwdGhlJTIwcmVsZXZhbmNlJTIwYW5kJTIwc2V2ZXJpdHklMjBvZiUyMGFuJTIwYWxlcnQuJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUyMCUyMCUzQ3RyJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VMb2clMjBNYW5hZ2VtZW50JTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVN0b3JlcyUyMGFuZCUyMHJldGFpbnMlMjBzZWN1cml0eSUyMGRhdGEuJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVN1cHBvcnRzJTIwaW52ZXN0aWdhdGlvbnMlMkMlMjByZXBvcnRpbmclMjBhbmQlMjBhdWRpdCUyMGV2aWRlbmNlLiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFVnVsbmVyYWJpbGl0eSUyMFNjYW5uZXJzJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRUlkZW50aWZ5JTIwa25vd24lMjB2dWxuZXJhYmlsaXRpZXMlMkMlMjBvdXRkYXRlZCUyMHNvZnR3YXJlJTIwYW5kJTIwcG90ZW50aWFsbHklMjBpbnNlY3VyZSUyMGNvbmZpZ3VyYXRpb25zJTIwYWNyb3NzJTIwc3lzdGVtcyUyMGFuZCUyMGluZnJhc3RydWN0dXJlLiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VIZWxwJTIwb3JnYW5pemF0aW9ucyUyMHVuZGVyc3RhbmQlMjB3ZWFrbmVzc2VzJTIwdGhhdCUyMGNvdWxkJTIwYmUlMjBleHBsb2l0ZWQlMjBhbmQlMjBwcm92aWRlJTIwY29udGV4dCUyMGZvciUyMHByaW9yaXRpemluZyUyMHNlY3VyaXR5JTIwcmlza3MuJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUzQyUyRnRib2R5JTNFJTBBJTNDJTJGdGFibGUlM0U=[\/vc_raw_html][vc_column_text]AProviders differ in the platforms they support and the degree of flexibility they offer. Some standardize their services around a limited number of technologies, while others can integrate the <a href=\"https:\/\/sits.com\/en\/cyber-defense-center\/siem\/\">SIEM<\/a>, <a href=\"https:\/\/sits.com\/en\/cyber-defense-center\/mxdr\/\">EDR or XDR<\/a> platforms an organization already uses. Before you commit, ask three questions:<\/p>\n<ol>\n<li>Which of your current tools are supported?<\/li>\n<li>How will your data sources be integrated?<\/li>\n<li>Can your existing security investments remain in use?<\/li>\n<\/ol>\n<p>What you connect determines what a managed SOC can actually see and detect, making the right logs and data sources a critical part of the planning process.[\/vc_column_text][\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-up\"][vc_column]<div class=\"smx_global_spacer size-s\"><\/div>\n<h2  class=\"h2 smx-headline \">What problems does a Managed SOC solve?<\/h2>[vc_column_text]Organizations often consider a managed SOC when their internal teams cannot maintain sufficient security visibility or respond consistently across their entire environment.<\/p>\n<ul>\n<li><strong>No coverage outside office hours<\/strong><strong>:<\/strong> Attackers favor nights, weekends and holidays. Covering those hours internally takes several people per analyst role, not one hire.<\/li>\n<li><strong>Alert overload:<\/strong> Security tools produce far more alerts than a small team can investigate, so real threats get lost in the noise. A SOC closes or tunes out false positives instead of forwarding them.<\/li>\n<li><strong>Skills shortage:<\/strong> Detection engineering and incident investigation are specialist skills that are hard to hire and retain.<\/li>\n<li><strong>Visibility gaps:<\/strong> Cloud, SaaS, remote endpoints and identity systems each hold part of the picture. A SOC correlates them.<\/li>\n<li><strong>Slow response:<\/strong> Time to detect and time to respond decide how much damage an incident does. Defined triage and escalation paths shorten both.<\/li>\n<\/ul>\n<p>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n<h2  class=\"h2 smx-headline \">Which Organizations need a Managed SOC<\/h2>[vc_column_text]<\/p>\n<p class=\"FirstParagraph\"><span lang=\"EN-US\">A managed SOC can support organizations of different sizes and maturity levels. It is particularly relevant for:<\/span><\/p>\n<ul>\n<li><strong>Mid-sized companies<\/strong> that require mature security monitoring but cannot justify the cost and staffing required for a complete internal SOC.<\/li>\n<li><strong>Enterprises<\/strong> that want to extend coverage outside standard working hours, add investigative capacity or bring specific environments under continuous monitoring.<\/li>\n<li><a href=\"https:\/\/sits.com\/en\/blog\/cybersecurity-kpi-making-security-measurable\/\"><strong>Regulated organizations<\/strong><\/a> that need to demonstrate structured monitoring and incident handling, for example in connection with <a href=\"https:\/\/sits.com\/en\/blog\/nis2-dora-supply-chain\/\">NIS2<\/a> or <a href=\"https:\/\/sits.com\/en\/blog\/iso-27001-certification-without-delay\/\">ISO 27001<\/a>.<\/li>\n<li><strong>Cloud-heavy or hybrid organizations<\/strong> whose attack surface has grown faster than their internal visibility.<\/li>\n<li><strong>Organizations without a dedicated security team <\/strong>that nevertheless require structured monitoring and access to security expertise.<\/li>\n<\/ul>\n<p>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-down\"][vc_column]<h2  class=\"h2 smx-headline \">What\u2019s the difference between Managed SOC vs Internal SOC?<\/h2>[vc_column_text]Both internal and managed SOCs aim to detect, investigate and coordinate the response to security threats. The main differences concern staffing, operational responsibility, implementation effort and the level of direct control retained by the organization.[\/vc_column_text]<h3  class=\"h3 smx-headline \">Managed SOC vs Internal SOC<\/h3>[vc_raw_html]JTNDc3R5bGUlM0UlMjAlMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMCU3QiUwQSUyMCUyMCUyMCUyMGJvcmRlci1jb2xsYXBzZSUzQSUyMGNvbGxhcHNlJTNCJTBBJTIwJTIwJTIwJTIwd2lkdGglM0ElMjAxMDAlMjUlM0IlMEElMjAlMjAlMjAlMjBmb250LWZhbWlseSUzQSUyMHNhbnMtc2VyaWYlM0IlMEElMjAlMjAlN0QlMEElMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMHRoJTJDJTBBJTIwJTIwdGFibGUudGhyZWF0LWluZm8tdGFibGUlMjB0ZCUyMCU3QiUwQSUyMCUyMCUyMCUyMGJvcmRlciUzQSUyMDJweCUyMHNvbGlkJTIwJTIzZmZmZmZmMzMlM0IlMEElMjAlMjAlMjAlMjBwYWRkaW5nJTNBJTIwMjBweCUzQiUwQSUyMCUyMCUyMCUyMGNvbG9yJTNBJTIwJTIzZmZmZmZmJTNCJTBBJTIwJTIwJTIwJTIwdmVydGljYWwtYWxpZ24lM0ElMjB0b3AlM0IlMEElMjAlMjAlN0QlMEElMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMHRoZWFkJTIwdGglMjAlN0IlMEElMjAlMjAlMjAlMjBiYWNrZ3JvdW5kLWNvbG9yJTNBJTIwJTIzZGVkYzAwJTNCJTBBJTIwJTIwJTIwJTIwY29sb3IlM0ElMjAlMjMwMDAwMDAlM0IlMEElMjAlMjAlMjAlMjBmb250LXdlaWdodCUzQSUyMGJvbGQlM0IlMEElMjAlMjAlMjAlMjB0ZXh0LWFsaWduJTNBJTIwbGVmdCUzQiUwQSUyMCUyMCU3RCUwQSUwQSUyMCUyMHRhYmxlLnRocmVhdC1pbmZvLXRhYmxlJTIwdGJvZHklMjB0ZCUyMCU3QiUwQSUyMCUyMCUyMCUyMGJhY2tncm91bmQtY29sb3IlM0ElMjAlMjMwYzJmNDglM0IlMEElMjAlMjAlN0QlMEElM0MlMkZzdHlsZSUzRSUwQSUwQSUzQ3RhYmxlJTIwY2xhc3MlM0QlMjJ0aHJlYXQtaW5mby10YWJsZSUyMiUzRSUwQSUyMCUyMCUzQ3RoZWFkJTNFJTBBJTIwJTIwJTIwJTIwJTNDdHIlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0aCUzRSUzQyUyRnRoJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGglM0VJbnRlcm5hbCUyMFNPQyUzQyUyRnRoJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGglM0VNYW5hZ2VkJTIwU09DJTNDJTJGdGglM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUzQyUyRnRoZWFkJTNFJTBBJTIwJTIwJTNDdGJvZHklM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFVGltZSUyMHRvJTIwb3BlcmF0ZSUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VVc3VhbGx5JTIwbW9udGhzJTJDJTIwZHVlJTIwdG8lMjByZWNydWl0bWVudCUyQyUyMHRvb2xpbmclMjBhbmQlMjBkZXZlbG9wbWVudCUyMG9mJTIwZGV0ZWN0aW9uJTIwY2FwYWJpbGl0aWVzJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVR5cGljYWxseSUyMHdlZWtzJTJDJTIwZGVwZW5kaW5nJTIwb24lMjB0aGUlMjBudW1iZXIlMjBvZiUyMGRhdGElMjBzb3VyY2VzJTIwYW5kJTIwaG93JTIwcXVpY2tseSUyMGFjY2VzcyUyMGlzJTIwZ3JhbnRlZCUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFU3RhZmZpbmclM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFVGhlJTIwb3JnYW5pemF0aW9uJTIwcmVjcnVpdHMlMkMlMjB0cmFpbnMlMkMlMjByZXRhaW5zJTIwYW5kJTIwc2NoZWR1bGVzJTIwaXRzJTIwb3duJTIwYW5hbHlzdHMlM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFQW5hbHlzdHMlMjBhcmUlMjBwcm92aWRlZCUyMGFzJTIwcGFydCUyMG9mJTIwdGhlJTIwc2VydmljZSUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFMjQlMkY3JTIwY292ZXJhZ2UlM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFUmVxdWlyZXMlMjBtdWx0aXBsZSUyMHBlb3BsZSUyMHBlciUyMHNoaWZ0JTJDJTIwcGx1cyUyMGhvbGlkYXklMjBhbmQlMjBzaWNrbmVzcyUyMGNvdmVyJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRUF2YWlsYWJsZSUyMHdoZW4lMjBpbmNsdWRlZCUyMGluJTIwdGhlJTIwY29udHJhY3RlZCUyMHNlcnZpY2UlM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUzQyUyRnRyJTNFJTBBJTIwJTIwJTIwJTIwJTNDdHIlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRURldGVjdGlvbiUyMGV4cGVydGlzZSUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VMaW1pdGVkJTIwdG8lMjB5b3VyJTIwdGVhbSVFMiU4MCU5OXMlMjBleHBlcmllbmNlJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRURyYXdzJTIwb24lMjBhbmFseXN0cyUyMHdobyUyMGludmVzdGlnYXRlJTIwYWNyb3NzJTIwbWFueSUyMGVudmlyb25tZW50cyUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFQ29udHJvbCUyMGFuZCUyMGN1c3RvbWl6YXRpb24lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFRnVsbCUyMGNvbnRyb2wlMjBvdmVyJTIwcHJvY2Vzc2VzJTIwYW5kJTIwcHJpb3JpdGllcyUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VIaWdoJTJDJTIwYnV0JTIwc2hhcGVkJTIwYnklMjB0aGUlMjBjb250cmFjdCUyMGFuZCUyMGFncmVlZCUyMHBsYXlib29rcyUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFSW50ZXJuYWwlMjBrbm93bGVkZ2UlM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFU2VjdXJpdHklMjBrbm93bGVkZ2UlMjBhbmQlMjBvcGVyYXRpb25hbCUyMGNvbnRleHQlMjByZW1haW4lMjBlbnRpcmVseSUyMGluLWhvdXNlJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRUtub3dsZWRnZSUyMGlzJTIwc2hhcmVkJTIwYmV0d2VlbiUyMHRoZSUyMHByb3ZpZGVyJTIwYW5kJTIwY3VzdG9tZXIlMjB0aHJvdWdoJTIwcmVwb3J0aW5nJTJDJTIwcmV2aWV3cyUyMGFuZCUyMHJlZ3VsYXIlMjBjb2xsYWJvcmF0aW9uJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUyMCUyMCUzQ3RyJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VDb3N0JTIwcHJvZmlsZSUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VTYWxhcmllcyUyQyUyMHRvb2xpbmclMkMlMjB0cmFpbmluZyUyMGFuZCUyMHR1cm5vdmVyJTJDJTIwb2Z0ZW4lMjB1bmRlcmVzdGltYXRlZCUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VQcmVkaWN0YWJsZSUyMHJlY3VycmluZyUyMGZlZSUyMHRpZWQlMjB0byUyMHNjb3BlJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUyMCUyMCUzQ3RyJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VSZW1lZGlhdGlvbiUyMGFuZCUyMHJpc2slMjBkZWNpc2lvbnMlM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFUmVtYWluJTIwdGhlJTIwb3JnYW5pemF0aW9uJUUyJTgwJTk5cyUyMHJlc3BvbnNpYmlsaXR5JTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRUFsc28lMjByZW1haW4lMjB0aGUlMjBvcmdhbml6YXRpb24lRTIlODAlOTlzJTIwcmVzcG9uc2liaWxpdHkuJTIwV2l0aCUyMGFjdGl2ZSUyMHJlc3BvbnNlJTJDJTIwdGhlJTIwU09DJTIwY2FuJTIwY2FycnklMjBvdXQlMjBwcmVkZWZpbmVkJTIwY29udGFpbm1lbnQlMjBhY3Rpb25zJTIwb24lMjB0aGUlMjBvcmdhbml6YXRpb24lRTIlODAlOTlzJTIwYmVoYWxmJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUzQyUyRnRib2R5JTNFJTBBJTNDJTJGdGFibGUlM0U=[\/vc_raw_html][vc_column_text]The last row is the one most often misunderstood. A managed SOC reduces the need to build and operate an internal monitoring function, but it does not remove the organization\u2019s responsibility for remediation, governance or risk ownership. A co-managed model sits between the two approaches. It allows the provider and customer to divide responsibilities according to the organization\u2019s existing resources, expertise and priorities.[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]<h2  class=\"h2 smx-headline \">Key Takeaways<\/h2>[vc_column_text]<\/p>\n<ul>\n<li><a href=\"https:\/\/sits.com\/en\/blog\/managed-soc-services-guide\/\"><strong>A Managed SOC<\/strong><\/a> provides <strong>security monitoring, alert triage, investigation, escalation and reporting<\/strong> as a managed service.<\/li>\n<li>Alerts are analyzed in stages so that routine cases can be resolved efficiently and <strong>analysts can focus on genuine threats<\/strong>.<\/li>\n<li>A managed SOC helps organizations manage security risk, but it <strong>cannot eliminate that risk<\/strong>.<\/li>\n<li><strong>Effective monitoring<\/strong> depends on suitable data sources, clearly defined responsibilities and an internal contact who can respond to escalations.<\/li>\n<li>Managed SOC services are particularly relevant for organizations that <strong>cannot cover all hours<\/strong> internally, <strong>struggle with alert volumes<\/strong> or need to demonstrate structured incident detection and handling.<\/li>\n<li>Full remediation, governance and risk ownership <strong>remain with the customer<\/strong>.<\/li>\n<li>If <strong>active response<\/strong> is included, the SOC can carry out agreed <strong>containment actions<\/strong> within the permissions granted by the customer.<\/li>\n<\/ul>\n<p>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n<h2  class=\"h2 smx-headline \">Managed SOC Services from the SITS Cyber Defense Center<\/h2>[vc_column_text]<a href=\"https:\/\/sits.com\/en\/about-us\/\">SITS<\/a> delivers managed SOC services through the <a href=\"https:\/\/sits.com\/en\/cyber-defense-center\/\">SITS Cyber Defense Center<\/a>, <span lang=\"EN-US\">a European operation with SOC analysts in Germany and Denmark. The service combines structured investigation processes, flexible technology integration and optional active response capabilities.<\/span><\/p>\n<p><strong>AI-assisted triage, analyst-led investigation<\/strong><\/p>\n<p>Before an alert reaches an analyst, in-house AI models predict its severity. They cross-check it against incidents that were previously investigated, so close matches to resolved cases can be de-escalated or closed. All remaining alerts pass through structured levels of analysis:<\/p>\n<ul>\n<li>A fast initial assessment of the incident data<\/li>\n<li>A broader investigation of related activity before and after the event<\/li>\n<li>In-depth analysis using threat intelligence and threat hunting where needed<\/li>\n<\/ul>\n<p>If an incident outgrows the SOC, it is handed to the <a href=\"https:\/\/sits.com\/en\/cyber-defense-center\/csirt\/\">SITS Incident Response Team<\/a> <span lang=\"EN-US\">with the initial triage and evidence collection already completed.<\/span><\/p>\n<p><strong>Your existing tools, or ours<\/strong><\/p>\n<p>The service is delivered primarily using IBM QRadar, Elastic Security and <a href=\"https:\/\/sits.com\/en\/microsoft-services\/threat-protection\/\">Microsoft Sentinel<\/a><span lang=\"EN-US\">, together with Elastic Defend and Microsoft Defender for EDR\/XDR. These are the platforms on which the Cyber Defense Center has particularly extensive experience, but they are not mandatory. If your organization already operates a different SIEM, EDR or XDR solution, it can be integrated so that existing security investments remain in use. The precise technical setup varies according to the platform. Whatever the source, events are handled through SITS\u2019s in-house SOAR platform, IntellAgent, with the same standardized processes. The compatibility of individual tools is confirmed during service scoping.<\/span><\/p>\n<p><strong>Active Responder<\/strong><\/p>\n<p>Active Responder is SITS\u2019s active response add-on for packages that include detection and response. Depending on the agreed permissions and technical capabilities of the connected platforms, analysts can:<\/p>\n<ul>\n<li>Isolate endpoints<\/li>\n<li>Revoke sessions<\/li>\n<li>Reset passwords<\/li>\n<li>Suspend accounts<\/li>\n<li>Blacklist indicators of compromise (IoCs)<\/li>\n<li>Block malicious processes<\/li>\n<\/ul>\n<p>To enable these actions, the customer provides API keys or service credentials for the relevant security platforms, such as Microsoft Defender, Microsoft Sentinel or Cortex XDR. The permissions are limited to the actions agreed within the service. The customer remains responsible for granting and maintaining these access rights.<\/p>\n<p><strong><span lang=\"EN-US\">Fast onboarding<\/span><\/strong><\/p>\n<p class=\"FirstParagraph\"><span lang=\"EN-US\">With predefined use cases, technical implementation takes four to six days on average. Full operational readiness takes roughly two to three weeks. Complex environments involving multiple data sources may require additional time.<\/span><\/p>\n<p>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n<h3  class=\"h3 smx-headline \">Customer Case: Sunweb Group<\/h3>[vc_column_text]The Sunweb Group is a <strong>European tour operator<\/strong> with around <strong>500 employees<\/strong>, active in <strong>seven countries<\/strong>. Its small internal security team was stretched by day-to-day phishing handling and alert triage. SITS took over operational security monitoring, while the two teams jointly developed the necessary playbooks. Sunweb was also able to make greater use of its existing Microsoft E5 licenses. False positives fell markedly and Sunweb\u2019s team now spends its time on assessments, new capabilities and improvements.<\/p>\n<p><em>\u201cSITS focuses on the security operational aspects handling incident triage and phishing email reports, enabling us, the internal security team at Sunweb, to focus on strategic initiatives, like rolling out new capabilities, conducting assessments and actually fixing things.\u201d<\/em><\/p>\n<p><strong>- Cristian Posariu, Head of Information Security, Sunweb<\/strong>[\/vc_column_text]<div class=\"btn-wrapper \">\n    <div class=\"btn btn btn--green\">\n        <a href=\"https:\/\/sits.com\/en\/customer-stories\/security-operations-center-for-sunweb\/\" class=\"btn-text\" title=\"Read the Sunweb customer story\">\n            Read the Sunweb customer story        <\/a>\n        <div><\/div>\n    <\/div> \n<\/div><div class=\"smx_global_spacer size-s\"><\/div>\n<h3  class=\"h3 smx-headline \">Is your security monitoring keeping up?<\/h3>[vc_column_text]Find out how a managed SOC could strengthen security monitoring across your environment, close coverage gaps and support your internal team.[\/vc_column_text]<div class=\"btn-wrapper \">\n    <div class=\"btn btn--inverted btn--green\">\n        <a href=\"https:\/\/sits.com\/en\/contact\" class=\"btn-text\" title=\"Get a free consultation\">\n            Get a free consultation        <\/a>\n        <div><\/div>\n    <\/div> \n<\/div>[\/vc_column][\/vc_row]<\/p>\n<\/section>","protected":false},"excerpt":{"rendered":"<p>[vc_row][vc_column][vc_column_text]A Security Operations Center is the function responsible for detecting, investigating and handling security incidents within an organization. Despite the name, a SOC is less about a physical room full of screens and more about a security capability built from three parts: Data: Logs and alerts from your systems, such as sign-ins, endpoints, firewalls, cloud [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":36602,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":"","_members_access_role":[],"_members_access_error":""},"categories":[420],"tags":[],"class_list":["post-36622","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-defense"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>What is a Managed SOC? A Practical Guide | SITS<\/title>\n<meta name=\"description\" content=\"What a managed SOC is, what the team does, which tools it uses and how it compares with an internal SOC. A plain-language guide for security leaders.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What is a Managed SOC? A Practical Guide | SITS\" \/>\n<meta property=\"og:description\" content=\"What a managed SOC is, what the team does, which tools it uses and how it compares with an internal SOC. A plain-language guide for security leaders.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/\" \/>\n<meta property=\"og:site_name\" content=\"SITS\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-16T16:40:44+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-16T16:40:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Managed-SOC-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"1787\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Charlotte Olscha\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Charlotte Olscha\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/\"},\"author\":{\"name\":\"Charlotte Olscha\",\"@id\":\"https:\/\/sits.com\/en\/#\/schema\/person\/a096e5a6430c2d0f74c324b7c9f47102\"},\"headline\":\"What is a Managed SOC?\",\"datePublished\":\"2026-10-16T16:40:44+00:00\",\"dateModified\":\"2026-10-16T16:40:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/\"},\"wordCount\":3989,\"publisher\":{\"@id\":\"https:\/\/sits.com\/en\/#organization\"},\"image\":{\"@id\":\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Managed-SOC-1.jpg\",\"articleSection\":[\"Cyber Defense\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/\",\"url\":\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/\",\"name\":\"What is a Managed SOC? A Practical Guide | SITS\",\"isPartOf\":{\"@id\":\"https:\/\/sits.com\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Managed-SOC-1.jpg\",\"datePublished\":\"2026-10-16T16:40:44+00:00\",\"dateModified\":\"2026-10-16T16:40:45+00:00\",\"description\":\"What a managed SOC is, what the team does, which tools it uses and how it compares with an internal SOC. A plain-language guide for security leaders.\",\"breadcrumb\":{\"@id\":\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#primaryimage\",\"url\":\"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Managed-SOC-1.jpg\",\"contentUrl\":\"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Managed-SOC-1.jpg\",\"width\":1000,\"height\":1787},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\/\/sits.com\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What is a Managed SOC?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/sits.com\/en\/#website\",\"url\":\"https:\/\/sits.com\/en\/\",\"name\":\"SITS\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/sits.com\/en\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/sits.com\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/sits.com\/en\/#organization\",\"name\":\"SITS\",\"url\":\"https:\/\/sits.com\/en\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/sits.com\/en\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/sits.com\/wp-content\/uploads\/2024\/04\/sits-logo-new.svg\",\"contentUrl\":\"https:\/\/sits.com\/wp-content\/uploads\/2024\/04\/sits-logo-new.svg\",\"width\":557,\"height\":322,\"caption\":\"SITS\"},\"image\":{\"@id\":\"https:\/\/sits.com\/en\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/sits.com\/en\/#\/schema\/person\/a096e5a6430c2d0f74c324b7c9f47102\",\"name\":\"Charlotte Olscha\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/sits.com\/en\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c268c10d74bec8f11f59ba984aa26b6d1b8b5a99a5b95547c4db1b486e6a1538?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c268c10d74bec8f11f59ba984aa26b6d1b8b5a99a5b95547c4db1b486e6a1538?s=96&d=mm&r=g\",\"caption\":\"Charlotte Olscha\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What is a Managed SOC? A Practical Guide | SITS","description":"What a managed SOC is, what the team does, which tools it uses and how it compares with an internal SOC. A plain-language guide for security leaders.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/","og_locale":"en_GB","og_type":"article","og_title":"What is a Managed SOC? A Practical Guide | SITS","og_description":"What a managed SOC is, what the team does, which tools it uses and how it compares with an internal SOC. A plain-language guide for security leaders.","og_url":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/","og_site_name":"SITS","article_published_time":"2026-10-16T16:40:44+00:00","article_modified_time":"2026-10-16T16:40:45+00:00","og_image":[{"width":1000,"height":1787,"url":"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Managed-SOC-1.jpg","type":"image\/jpeg"}],"author":"Charlotte Olscha","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Charlotte Olscha","Estimated reading time":"15 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#article","isPartOf":{"@id":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/"},"author":{"name":"Charlotte Olscha","@id":"https:\/\/sits.com\/en\/#\/schema\/person\/a096e5a6430c2d0f74c324b7c9f47102"},"headline":"What is a Managed SOC?","datePublished":"2026-10-16T16:40:44+00:00","dateModified":"2026-10-16T16:40:45+00:00","mainEntityOfPage":{"@id":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/"},"wordCount":3989,"publisher":{"@id":"https:\/\/sits.com\/en\/#organization"},"image":{"@id":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#primaryimage"},"thumbnailUrl":"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Managed-SOC-1.jpg","articleSection":["Cyber Defense"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/","url":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/","name":"What is a Managed SOC? A Practical Guide | SITS","isPartOf":{"@id":"https:\/\/sits.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#primaryimage"},"image":{"@id":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#primaryimage"},"thumbnailUrl":"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Managed-SOC-1.jpg","datePublished":"2026-10-16T16:40:44+00:00","dateModified":"2026-10-16T16:40:45+00:00","description":"What a managed SOC is, what the team does, which tools it uses and how it compares with an internal SOC. A plain-language guide for security leaders.","breadcrumb":{"@id":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#primaryimage","url":"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Managed-SOC-1.jpg","contentUrl":"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Managed-SOC-1.jpg","width":1000,"height":1787},{"@type":"BreadcrumbList","@id":"https:\/\/sits.com\/en\/blog\/was-ist-ein-managed-soc\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/sits.com\/en\/"},{"@type":"ListItem","position":2,"name":"What is a Managed SOC?"}]},{"@type":"WebSite","@id":"https:\/\/sits.com\/en\/#website","url":"https:\/\/sits.com\/en\/","name":"SITS","description":"","publisher":{"@id":"https:\/\/sits.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sits.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/sits.com\/en\/#organization","name":"SITS","url":"https:\/\/sits.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/sits.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/sits.com\/wp-content\/uploads\/2024\/04\/sits-logo-new.svg","contentUrl":"https:\/\/sits.com\/wp-content\/uploads\/2024\/04\/sits-logo-new.svg","width":557,"height":322,"caption":"SITS"},"image":{"@id":"https:\/\/sits.com\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/sits.com\/en\/#\/schema\/person\/a096e5a6430c2d0f74c324b7c9f47102","name":"Charlotte Olscha","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/sits.com\/en\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/c268c10d74bec8f11f59ba984aa26b6d1b8b5a99a5b95547c4db1b486e6a1538?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c268c10d74bec8f11f59ba984aa26b6d1b8b5a99a5b95547c4db1b486e6a1538?s=96&d=mm&r=g","caption":"Charlotte Olscha"}}]}},"_links":{"self":[{"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/posts\/36622","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/comments?post=36622"}],"version-history":[{"count":5,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/posts\/36622\/revisions"}],"predecessor-version":[{"id":36627,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/posts\/36622\/revisions\/36627"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/media\/36602"}],"wp:attachment":[{"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/media?parent=36622"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/categories?post=36622"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/tags?post=36622"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}