Security Operations as a Service (SOCaaS)

OVERVIEW

We work closely with clients to handle incidents efficiently and keep them informed throughout the resolution process, ensuring that their digital assets and organizations are safeguarded against cyber threats. SOCaaS provides clients with top-tier cyber threat defense, offering peace of mind and the ability to focus on their core business operations.

Security controls are in place to allow the operations team to remain functional and productive without exposing the essential details of incidents to the wider world. Indicatively and not exhaustively those include physical access controls, multi-factor authentication, secure networks, secure cloud-hosted security capabilities, real-time secure collaboration solutions, and, of course, strong encryption.

SERVICE CAPABILITIES

Obrela provides continuous and uninterrupted operations security and situational awareness through a grid of global Resilience Operation Centers (ROCs).

Our ROCs in Europe and Middle East are purpose-built to operate 24x7x365, capable of withstanding regional physical disasters and equipped with the latest technology to provide resilience.

The service level includes real-time security monitoring including analysis and validation of the alerts, their interpretation to meaningful and actionable information and escalation based on mutually agreed RoE.

Security events and alerts are analyzed and manually validated by certified Analysts and escalated to the Customer subject to the corresponding severity level.

Obrela provides real near-time event management by including analysis and validation of the alerts, their interpretation to meaningful and actionable information, escalation based on mutually agreed Rules of Engagement (RoE) and guidance throughout the lifecycle of security events until their mitigation and recovery.

More specifically, as part of our offering our analysts will investigate identified anomalous incidents and create a different case for every verified incident leveraging the advanced case management capabilities of our SWORDFISH platform (SWORDFISH® CyberOPS). Each case encloses all relevant attributes of the specific event such as criticality, event type, the relevant alerts that triggered the event, artifacts, actions taken, concerned parties (both internal and external to the Client), remedial recommendations and root cause analysis. At the end of the investigation, we will produce a report documenting all findings throughout an investigation. Furthermore, we will provide a proposed remediation plan for ensuring incident eradication and mitigating similar threats.

Reporting capabilities include the following:

Reporting via CyberOPS: Predefined automatic reports are available by the system and accessible by the Client via the Swordfish CyberOPS web console provided by OSI. Customers may request new or ad-hoc reports which can be produced on a best-effort approach and subject to effort required.
Customer-designated Security Event Notification: User’s notification through an automatically generated e-mail forwarded to the User’s security Point of Contact(s) for customer-designated alerts