
Power to the people
The solution also provides the key aspects of SOC team and skills building to allow you to quickly start using/offering MDR as well as give you the ability to scale the MDR services for future workloads. We provide:
- A clear organisational structure of the SOC with defined roles based on the SOC service catalog (analysts, incident responders, threat hunters, forensic specialists).
- A list of the required skills for each SOC team role and a road map (shadowing, mentoring, trainings, certifications) on how to achieve them.
- The design of the onboarding process for new team members.
If you are unable to provide or ramp up the required human resources, NIL can provide an on-site or remote SOC team temporarily, either for faster time-to-market, or in a tiered architecture to provide for missing local skills.
Support for different platforms and frameworks
We are flexible in the choice of technology to support a wide range of SOC platform tools and frameworks. We typically base our SOC platform around the following key framework components:
- A high-assurance compute-network-storage environment in which the SOC technology platform executes (secure analyst room, secure platforms, secure infrastructure, privileged identity management, high-assurance authentication, transmission protection, separation of duty, etc.)
- A Security Automation and Orchestration (SOAR) solution as the core automation and eyes-on-the-glass component of the SOC.
- One or multiple Security Information and Event Management (SIEM) systems for event consolidation, normalization, and short-term correlation.
- The integration of internal and external Threat Intelligence (TI) sources, and automatic correlation of TI with the local context.
- Information sources from multiple endpoint technologies, such as EDR agents, application and OS logs, HIPS/anti-malware systems, DLP systems, vulnerability assessment and management tools, etc.
- Information sources from multiple network technologies, such as NGFW/NGIPS/WAF appliances, network anomaly detection, NetFlow accounting, etc.
- Information sources from specific, user- or data-focused security technologies, such as UEBA, or database monitoring/firewalling.
- Deception technologies, such as honeypots, honeytokens, tarpits, and network sinkholes.
- Data management tools for retention, fast searching, etc.
Our goal is to support the majority of critical information sources in customer environments as well as to provide easy-to-replace framework components that eliminate long-term lock-in to specific vendors.


