What a SIEM and a SOC Are
Written by MSP Outpost.
In Short
A SIEM collects logs from firewalls, servers, identity and cloud services and correlates them to find an attack that no single tool would flag. A SOC is the team of analysts that watches those alerts around the clock and acts on them. Most MSPs buy the two together as a managed service, and it differs from EDR, which watches only the endpoint it is installed on.
What It Does
- Log collection. Pulls logs from endpoints, firewalls, identity and cloud services into one place.
- Correlation. Links events across sources, such as a risky sign-in followed by a new mailbox rule, into one alert.
- Overnight cover. Analysts review alerts at night and at weekends, when your own team is not watching.
- Response. Isolates a machine, disables an account or blocks an address, within limits you agree in advance.
- Investigation. Explains what happened, what was touched and what to do next, in a report you can give the client.
- Log retention. Keeps logs for a set period, which some insurers and client contracts ask for.
When You Need One
A self-run SIEM is out of reach and you do not need one. EDR with a managed response service covers the endpoints, and that is the right first step.
Clients with cloud services, remote staff and insurance requirements need someone watching identity and email as well as endpoints. A managed SOC priced per user or per endpoint is usually how an MSP this size gets that cover.
You may bring some analysis in house or run a SIEM yourself, but staffing nights and weekends is still the hard part. Decide clearly which alerts the SOC acts on and which it hands back to you.
What to Look For
Must Have
- Human Monitoring Around the Clock
- Identity and Cloud Coverage
- Agreed Response Actions
- Multi-Tenant Reporting
- PSA Ticket Integration
- Clear Escalation Path
Worth Having
- Bring Your Own EDR
- Long Log Retention
- Threat Hunting
- Client-Ready Incident Reports
- Compliance Reporting
How It Is Priced
Almost every vendor in this category quotes rather than publishes a price. Managed SOC services are usually priced per user or per endpoint each month, while a self-run SIEM is often priced by log volume, which can grow faster than your client count. Watch for ingestion caps, extra charges for longer retention, and incident response hours billed on top.
Switching
Moving a SOC means redeploying agents or connectors at every client and rebuilding the rules about who gets called and what the SOC may do on its own. Log history rarely comes with you, so check how long you can still reach old logs after you leave. Settle the term and the notice period before you sign, since some contracts run for several years.
Questions to Ask a Vendor
- Which response actions will your analysts take without asking me, and which do they only recommend?
- How many alerts per client per month should I expect to be escalated to my team?
- Do I have to use your agent, or can you work with the EDR I already run?
- What is included in the price, and at what point does incident response become billable?
- How long are logs kept, and can I still get them after the contract ends?
- Are the analysts watching my clients your own staff, or a subcontractor?
