DOZOR
Demo

Building a SOC on Dozor

We deploy Dozor inside your perimeter, connect sources and tune detection to your systems. We write shift procedures and train analysts to work with AI investigation.

Discuss your taskAll services
Duty shift queueSample shift in Dozor
  1. INC-2041External SSH sign-in by a service accountCritical
  2. INC-2038A series of failed VPN sign-ins from one addressHigh
  3. INC-2035New service on a domain controllerHigh
  4. INC-2029PowerShell launched from an email attachmentMedium
  5. INC-2024Planned update marked as routine workClosed

The shift sees the queue by severity and SLA deadline

What is included

Sources
Dozor agents on servers and workstations, logs from network equipment, clouds and your SIEM.
Detection
Rules for your systems and attack scenarios, coverage checks against MITRE ATT&CK.
Response
Playbooks and rights for response actions approved by a second person.
Processes
Shift procedures, severity levels, SLA deadlines, shift handover and escalation.
People
Analyst training, review of simulated attacks and support in the first months.

Photos: NASA Johnson Space Center, public domain; Cody Logan, CC BY-SA 4.0; Christopher Bowns, CC BY-SA 2.0; Syced, CC0, Wikimedia Commons.

Where we start

How we build it

  1. 01

    Assessment

    We study the infrastructure, event sources, current processes and regulatory requirements.

  2. 02

    Design

    We define sources, attack scenarios, shift roles and performance metrics.

  3. 03

    Deployment

    We install Dozor, connect sources and tune rules and response playbooks.

  4. 04

    Simulated attacks

    We test detection on MITRE ATT&CK scenarios and close the gaps.

  5. 05

    Handover

    We train the shift, hand over procedures and support the first months of work.

What you get

  • Working monitoring on Dozor inside your perimeter.
  • A MITRE ATT&CK coverage map with tested rules.
  • Procedures for the shift, escalation and response.
  • Trained analysts and a report on the simulated attacks.

Questions

Ask your own question
How many people does an in-house SOC need?

It depends on the number of sources and the operating mode: a 24/7 shift needs more analysts than a daytime one. We do the calculation during the assessment.

Can we keep our SIEM?

Yes. Dozor accepts its alerts over syslog, CEF, LEEF or JSON, and the AI investigates them together with agent data.

Where is monitoring data stored?

On your servers. Dozor runs inside your perimeter, and external connections stay off until you turn them on.

Discuss your task

Describe the task and the timeline. We will reply, clarify the scope and propose a plan.

  1. Contract. We start with a contract and a non-disclosure agreement. The scope of work and the permissions are put in writing.
  2. Scope. Goals, systems, timing and emergency contacts are agreed before the work starts.
  3. Work. We keep you updated as the work goes and report critical findings at once.
  4. Report. We hand over a management report and a technical report with evidence and recommendations.

Or write to us: info@dozorsecurity.kz

Request: SOC build-out