Managed SOC: AarSOC

Event collection from multiple simultaneous sources: systems, network, applications, cloud services. Normalisation, correlation and application of MITRE ATT&CK-aligned rules. Real-time alerts on detection of abnormal behaviour.

Alerts are automatically classified, enriched and prioritised. Technical identifiers (hostnames, accounts, internal IP addresses) are pseudonymised before any processing by an external model. No sensitive decision is made without prior analyst validation.

Each qualified alert provides access to full context: event timeline, correlation with prior activity, inventory of involved assets, associated indicators of compromise. The analyst has all the data without having to reconstruct it manually.

Documented and tested containment procedures: network isolation, session revocation, account lockout. Evidence collection with certifiable timestamps. Every response action is subject to human validation; no irreversible automated action is triggered without explicit confirmation.

Incident reports are encrypted with AES-256 before export. A unique password is generated for each delivery and transmitted via a separate channel; it is never stored in plaintext in our systems. Reports are bilingual, in French and English.

Isolation is enforced across three layers: transport (TLS 1.3 with client certificates), storage (separate encryption keys per organisation), application layer (role-based access control, no cross-tenant visibility possible).

Every action, human or automated, is logged with a timestamp, operator identifier and operation context. Audit logs are immutable and stored separately from operational logs.

Configuration data and operational data are backed up with encryption daily. Restoration procedures are tested periodically; results are documented.