24x7 Security Monitoring and Incident Management. 
Facilitates insights, remote support and remediation steps to help customer respond to threats and address vulnerabilities 
Provide pro-active threat hunting and IOC check managed devices
SOC validates Critical Security Alerts and delivers detailed information with actionable remediation within 1 hour as defined in escalation plan 
Collect and Analyze logs on Hazedawn's Threat analysis platform 
Provides customer with access to the Alert & Incident Portal for: 
- Visibility of information related to the services 
- Review the security alerts and incidents relating to their managed environment 
Continually build and enhance the knowledge base / customer profile to enable effective respond against future incidents. 
SOC work closely with customer to implement security best practices and to correct potential misconfigurations and protect against future incidents. 
Security log retention for up to 90 days. 
.
Best Practice Use Case development
Suspicious traffic from one source IP to many IP
Suspicious number of well-known ports connected from one source IP to one IP (port<1025)
System Configuration Changes Detected
Unblocked Threat Detected
Analysis any abnormal web traffic based on its Geolocation information 
Pro-active check with IOC database 
Abnormal login failure analysis
Detect Brute Force Attempts
Analysis of any abnormal change of account privilege
Implement honey user for pro-active monitoring 
Perform suspicious login analysis such as multiple logins, from other countries and non-office period