Documentation contents
AarSOC · Get started
Onboarding
The AarSOC start-up steps: scoping, tunnel, agents, machine approval, tuning. And the single flow to open on your network.
On this page
The steps
- Technical scoping: sources, critical machines, notifications.
- Connection: a WireGuard tunnel dedicated to your organisation, on your own subnet.
- Agent deployment with your teams.
- Machine approval by our SOC, machine by machine.
- Tuning: a few weeks of daily analysis of the first alerts, to adjust the rules to your activity, with your teams validating.
- Validation checkpoint before normal operations.
AarView shows the progress of each step. Proprietary applications or a hybrid environment extend the timeline, estimated during scoping.
What to open on your network
One outbound flow from your gateway: UDP 51820 to our WireGuard gateway, whose address we give you. No inbound port.
Inside the tunnel, your machines only reach:
| Destination | Ports |
|---|---|
| Agent collection | 1514 and 1515 |
| Network collectors (intrusion detection sensor and other network sources) | 5044 to 5047 |
| AarView | HTTPS |
Everything else is blocked.
How a machine joins your organisation
- Our collection agent enrols with a password sent outside the portal.
- That password is not enough: a machine is attached to your organisation only after our SOC explicitly approves it, machine by machine.
- Inside the tunnel, each agent talks to our collection servers over a connection encrypted with a key of its own.
- Network collectors authenticate with a client certificate (mutual TLS).
Agent impact
Our collection agent is lightweight and does not change the configuration of the monitored services. Its footprint depends on the volume of logs read and the checks enabled (file integrity, inventory). We can test it first in your staging environment.
With your existing SIEM
AarSOC can replace your monitoring tool or sit alongside it: alerts from your SIEM are sent to AarView by API, or read directly from an Elastic, OpenSearch or Wazuh. The choice is made during scoping. See What we collect.
An intermediate step
A collector installed on your site, connected to our collection servers. A full deployment in your own infrastructure is prepared case by case: see Sovereignty.