AarSOC overview

AarSOC is a service: the CyberAar team monitors your estate, qualifies alerts and supports you in the response. The platform is built on open-source components, and the service runs on AarView, CyberAar’s orchestration software, where you follow it.

What the service covers

• Detection and correlation: collection through agents, network and your existing SIEM; rules aligned with MITRE ATT&CK; ATT&CK coverage measured and shown; weekly threat hunting.
• Threat intelligence: indicator of compromise sharing, observable enrichment, indicator monitoring across your estate.
• Incident response: automation approved by an analyst, remote digital forensics, playbooks, reports in French and English.
• Continuous monitoring: vulnerabilities (actively exploited flaws first), CIS hardening posture, exfiltration detection, lookalike domains and password leaks.
• Your data: per-client isolation enforced in the database, retention from 6 to 24 months by offer, optional archive on your site, export at any time.

What each offer includes is detailed in Offers.

Service level

AarSOC operates 24/7 from commercial launch, with a 99.9% availability target. During the pilot programme, coverage runs from 06:00 to 24:00 WAT on working days, with on-call for critical alerts outside those hours. See Coverage and on-call.

Where to start

1. Offers: what each level adds.
2. Onboarding: the steps and what to open on your network.
3. Portal access: how your teams follow the service.
4. What we collect and Retention.
5. Sovereignty and confidentiality.

See also

• The AarSOC overview page and the FAQ, written for a CISO evaluating the service.
• The pilot programme.

Want to install AarView yourself, above your own SIEM? That is the AarView software: see the AarView documentation.