FAQ: AarSOC

A Wazuh agent installed on each machine sends its security events to our managers. Traffic goes through a WireGuard tunnel dedicated to your organisation, on your own subnet; inside it, each agent talks to the manager over a connection encrypted with a key of its own. Enrolment uses a password sent outside the portal, but that is not enough: a machine is attached to your organisation only after our SOC explicitly approves it, machine by machine. Beats collectors (Suricata and other network sources) authenticate with a client certificate (mutual TLS).

Through the agent: Linux and Windows systems (system logs, Sysmon, file integrity, inventory, vulnerabilities) and application logs read locally (syslog, JSON, Windows event logs). From an existing tool: alerts received by API from Wazuh, Elastic Security, Splunk, IBM QRadar, Microsoft Sentinel, Graylog and OpenSearch, or read directly from an Elastic, OpenSearch or Wazuh. We have no network syslog receiver: a network device is collected by an agent or a relay that reads its logs.

Wazuh decoders extract the fields (timestamp, host, user, addresses, event identifier), then rules qualify the event. The alert is enriched with a geolocation of public addresses computed on our servers (DB-IP database refreshed monthly, no call to an external service) and stored in your organisation's indices. Alerts received from a third-party SIEM are converted to a common schema before storage.

We write a Wazuh decoder and rules from a sample of your logs. The time needed depends on the format and its documentation. Sources identified during scoping are part of the initial scope; those discovered after start-up are covered by a contract amendment.

Your logs stay online, queryable in real time, for 6, 12 or 24 months depending on your offer (Sentinelle 6 months, Gardien 12 months, Citadelle and Souveraine 24 months). With Citadelle and Souveraine, a copy can also be kept on your own site. The duration is that of your offer, written into the contract, and cannot be modified without bilateral agreement.

Yes, in the AarView portal: the Events page searches your alerts over the last 30 days at most, by free text or by rule, machine and address. The server restricts every query to your organisation. An API with limited-scope keys gives access to your incidents and statistics and, with Citadelle and Souveraine, to the archive of your events. We do not keep raw logs that trigger no rule.

The platform applies no volume cap and never truncates your data. The covered scope (machines and sources) is defined in the contract; extending it is done by amendment.

Yes: the standard Wazuh rules, plus our own (privilege escalation, persistence, exfiltration, Active Directory attacks such as Kerberoasting, changes to sensitive files with the identity of who made them). Our rules are versioned and automatically tested before every deployment.

MITRE ATT&CK. When the rule defines it, each alert carries the corresponding technique and tactic. Depending on the offer, a portal page shows which techniques are actually covered on your estate.

Yes. We develop rules from the use cases you identify: abnormal behaviour on your critical applications, out-of-hours access to sensitive systems, unusual transfers. They rely on the logs already collected when the necessary data is there.

Four levels in AarView: low, medium, high, critical. For a Wazuh alert they follow the rule level (7 and above: medium, 12 and above: high, 15 and above: critical). An analyst can correct the severity during triage.

They are tuned during the first weeks on your normal activity, then after every reported false positive or significant change in your environment. Every rule change goes through our code repository and stays traceable.

In the portal and by email, in French then English; each user chooses: critical alerts only, all incidents, tickets assigned to them, daily summary. We can also push events (new alert, new case, status or severity change, finalised report) to your tool through a signed webhook, set up by our team. There is no native Jira, ServiceNow, Slack, Teams or SMS integration today.

A false positive is closed with its reason in the portal. If it recurs, the rule is refined or a documented exception is added to our versioned rules.

A critical alert triggers the on-call rota: the analyst on duty is paged, then the backup after 15 minutes without acknowledgement, then the whole team after 30 minutes. On-call for critical alerts is part of every offer.

Our team of analysts. Each client has a named referent analyst; Gardien adds a pair of analysts, Citadelle and Souveraine a team. An analyst only sees the clients assigned to them.

24/7 is part of Citadelle and Souveraine, from commercial launch. Every offer includes on-call for critical alerts. During the pilot programme, coverage runs from 06:00 to 24:00 WAT on working days: our team is spread across four time zones (Dakar WAT, Casablanca GMT+1, Paris GMT+1/+2, Montreal GMT-4/-5). We prefer to document the coverage actually provided at each stage rather than claim it in advance.

The platform measures the detection time and the handling time of every incident and shows them on your dashboard; our internal handling target is 4 hours. Contractual response times are set in your contract according to the offer.

We qualify the incident (scope, technique, affected machines), document its timeline in the portal and share the indicators of compromise. With Citadelle, we can collect evidence remotely on the machine without modifying it. We recommend containment actions suited to your context and support your internal team; failing that, an incident response engagement can be started.

Detection, qualification and investigation are included. Our automations are approved by an analyst whenever they concern a machine, and remote evidence collection only reads. We do not isolate machines, kill processes or delete files on your systems: operational response (containment, eradication, remediation) is a separate engagement, billed separately. We take no action on your infrastructure without your explicit mandate.

Your dashboard (score, response times, trends), incidents and alerts with their timeline, event search, your machines and their posture, vulnerabilities, tickets, messaging with your analyst and your reports. Depending on the offer: threat intelligence, hunting, lookalike domain and leaked account monitoring, and automations.

A period report (monthly by default) as a PDF, compared with the previous period, plus per-incident and per-machine reports, in French or English. Exported PDFs are encrypted. There is no weekly report.

In the offer operated by CyberAar, on our servers in Europe (Helsinki, Finland), with a European infrastructure provider. One exception: Citadelle's AI assistant sends pseudonymised extracts to an external model (Claude, by Anthropic); Souveraine and the pilot have no AI, and your data then never leaves our infrastructure. For stricter residency requirements, deployment in your own infrastructure is assessed case by case.

The analysts assigned to your organisation, the SOC administrators and the engineers who run the platform. An analyst who is not assigned to you does not see your data. Opening an incident and its evidence is logged, as is API access to your archive. No access is given to sales staff or third parties.

Yes, at several levels: each client has its own tunnel and subnet; a machine is attached to a client only after SOC approval; your alerts are stored in your own indices; the portal database separates data per client on every row; every portal query is filtered to your organisation by the server. There is no separate encryption key per client.

Only with Citadelle: alert triage, summaries and report drafts (beta). Before anything is sent to the model (Claude, by Anthropic), our servers replace machine names, addresses, accounts, emails and client names with tokens and mask secrets; sending is refused if any original value survives. The AI suggests, an analyst decides: it closes, assigns and escalates nothing. Souveraine and the pilot use no AI.

Exported PDFs are encrypted with AES-256 using a random password unique to each export, of which we keep only a hash. They travel over TLS and are accessible only to the accounts of your organisation authorised in the portal. They are never shared between clients.

On termination, your access is closed and collection stops. You can export your incidents (CSV) and, with Citadelle and Souveraine, the archive of your events (JSON). Your data is then deleted as set out in the contract. Our daily backups that still contain it expire on their own within the following 30 days: the deletion certificate is sent to you at that point.

It is possible: the platform is built on open-source components and the AarView portal is available under licence. Such a deployment is prepared case by case with your teams (installation, configuration, skills transfer). An intermediate step exists: a Wazuh collector installed on your site, connected to our managers.

The platform is built on open-source components. The underlying infrastructure can be taken over by any qualified third party. Your data remains yours and is exportable. Our orchestration layer and client portal are proprietary: a third party would need to redevelop them. For shared deployments, we commit contractually to provide a complete image of your environment with 90 days' notice should we cease operations.

No. Your data is exportable in standard formats (CSV, JSON) and alerts follow the open Wazuh format. The platform relies on open protocols. If you want to migrate or bring operations in-house, we provide the necessary documentation and transition support.

You keep your exported logs, reports and configurations. The detection rules developed for your context belong to you and can be exported: they are standard Wazuh rules.

Yes. The code of the underlying open-source components is public. Our orchestration layer and client portal are not published. For the shared environment, we accept supervised technical audits on request, within a scope and under conditions defined contractually. Our own information security management system is undergoing ISO/IEC 27001:2022 certification.

The technical connection (tunnel, agents, machine approval) is tracked step by step in the portal. A few weeks of tuning follow to adjust the rules to your activity, with your teams validating the first alerts. Proprietary applications or a hybrid environment extend this, estimated during scoping.

The Wazuh agent is lightweight and does not change the configuration of the monitored services. Its footprint depends on the volume of logs read and the checks enabled (file integrity, inventory). We can test it first in your staging environment.

Both are possible. AarSOC can replace your monitoring tool or sit alongside it: alerts from your SIEM (Splunk, QRadar, Sentinel, Elastic, Graylog, OpenSearch, Wazuh) are sent to AarView by API, or read directly from an Elastic, OpenSearch or Wazuh. The choice is made during scoping.

Yes. We push events to your tool through a signed webhook, and an API gives access to your incidents. There is no native Jira or ServiceNow connector today.

One outbound flow from your gateway: UDP 51820 to our WireGuard gateway, whose address we give you. No inbound port. Inside the tunnel, your machines only reach the collection ports (1514 and 1515 for agents, 5044 to 5047 for Beats collectors) and the portal; everything else is blocked.

Technical scoping (sources, critical machines, notifications), connection and agent deployment with your teams, a tuning period with daily analysis of the first alerts, then a validation checkpoint before normal operations. The portal shows the progress of each step.

Monthly, according to the chosen offer and the covered scope, set during scoping. There are no charges tied to the number of alerts or incidents. Pricing on request.

The four offers are cumulative. Sentinelle: monitoring, alerts and incidents, vulnerabilities, on-call for critical alerts, referent analyst, 6 months of retention. Gardien adds investigation, threat intelligence, posture, a pair of analysts and 12 months. Citadelle adds automations, remote digital forensics, hunting, 24/7, a team, the AI assistant, 24 months and the on-site archive. Souveraine is Citadelle without AI or any third-party service. Details on the Offers page.

For six months you get Citadelle's features, without the AI assistant, with a referent analyst. At the end of the pilot, a report documents the detections made, the false positives encountered and the adjustments made; you then choose an offer, or stop and leave with your data. The pilot's conditions are defined contractually.

Our ISMS is aligned with ISO/IEC 27001:2022 and the certification process is under way. We do not claim certification until it is obtained.

Yes, within the scope of our role. The platform contributes to the traceability of security events, the preservation of evidence and incident detection, all required by frameworks such as DORA, NIS 2 or local sector regulations. We document what the platform covers and what it does not, so you can integrate it correctly into your compliance file.

Yes. A non-disclosure agreement is signed before any exchange of sensitive information and before any access to your data. The service contract includes clauses specific to the confidentiality of log data.