Documentation contents
AarSOC · How it runs
Coverage and on-call
Who handles your AarSOC alerts, during which hours, how on-call for critical alerts works, and what we do once an incident is confirmed.
On this page
Who handles your alerts
Our team of analysts. Each client has a named referent analyst; Gardien adds a pair of analysts, Citadelle and Souveraine a team. An analyst only sees the clients assigned to them.
Coverage hours
- 24/7 is part of Citadelle and Souveraine, from commercial launch.
- During the pilot programme, coverage runs from 06:00 to 24:00 WAT on working days.
- Our team is spread across four time zones: Dakar (WAT), Casablanca (GMT+1), Paris (GMT+1/+2), Montreal (GMT-4/-5).
We prefer to document the coverage actually provided at each stage rather than claim it in advance.
On-call for critical alerts
Included in every offer. A critical alert triggers the on-call rota:
| Time without acknowledgement | Who is paged |
|---|---|
| immediately | the analyst on duty |
| 15 minutes | the backup |
| 30 minutes | the whole team |
Response times
The platform measures the detection time and the handling time of every incident and shows them on your dashboard. Our internal handling target is 4 hours. Contractual response times are set in your contract according to the offer.
Once an incident is confirmed
- We qualify the incident: scope, technique, affected machines.
- We document its timeline in the portal and share the indicators of compromise.
- With Citadelle, we can collect evidence remotely on the machine, without modifying it.
- We recommend containment actions suited to your context and support your internal team; failing that, an incident response engagement can be started.
What we do not do
We do not isolate machines, kill processes or delete files on your systems. Our automations are approved by an analyst whenever they concern a machine, and remote evidence collection only reads. Operational response (containment, eradication, remediation) is a separate engagement, billed separately. We take no action on your infrastructure without your explicit mandate.