SOC as a Service: What a Managed SOC Does and How to Choose a Provider in India

Hero Summary

A security operations centre (SOC) is the function that monitors an organization's systems around the clock, detects suspicious activity, investigates it, and coordinates the response. "SOC as a service" — often sold as managed detection and response (MDR) — provides that capability from a provider instead of building and staffing it in-house. For many organizations in India, a managed SOC is the practical way to get 24x7 coverage, and it also supports compliance duties such as CERT-In's six-hour incident reporting and 180-day log retention. This guide explains what a SOC does, the delivery models, and what to ask a provider.

Executive Summary

Attackers do not keep office hours, and most organizations cannot economically staff analysts around the clock. A SOC turns the flood of logs and alerts from endpoints, networks, cloud services, and identity systems into a small number of investigated incidents. This guide covers what a SOC does day to day, the in-house, hybrid, and managed models, the difference between a SOC, a SIEM, and MDR, the capabilities and questions that separate providers, and the Indian regulatory context. It closes with how Threat ResQ's SOC+ approaches the problem.

What does a SOC do? {#what}

A SOC's core work follows a cycle:

1. Collect telemetry — logs and signals from endpoints, servers, network devices, cloud platforms, email, and identity systems.
2. Detect suspicious activity using correlation rules, behavioural analytics, and threat intelligence.
3. Triage alerts, separating genuine threats from false positives.
4. Investigate confirmed incidents to establish what happened, which systems and accounts are affected, and how far the attacker has gone.
5. Respond — contain the threat, remove the attacker's access, and support recovery.
6. Improve — tune detections, close gaps, and feed lessons back into controls.

Why organizations outsource the SOC {#why}

• Round-the-clock coverage is expensive. Covering every hour of every day takes multiple shifts of skilled analysts.
• Talent is scarce and turns over quickly, and tooling needs ongoing engineering and tuning.
• Alert volume overwhelms small teams. Without correlation and triage, real incidents get lost in noise.
• Compliance expects monitoring and fast reporting, which is hard to demonstrate without a defined function.
• Speed matters. The longer an attacker remains undetected, the greater the damage. IBM's 2025 research for India put the average breach lifecycle — time to identify and contain — at 263 days.

SOC models {#models}

Model	How it works	Best suited to
In-house SOC	Your own staff, tools, and processes	Large organizations with sustained budget and talent
Managed SOC / SOC as a service	A provider monitors and responds on your behalf	Organizations that need 24x7 coverage without building it
Hybrid / co-managed	A provider covers out-of-hours or specific functions while your team handles the rest	Organizations with a small security team

SOC vs SIEM vs MDR {#terms}

• A SIEM (security information and event management) is a tool that collects and correlates log data and raises alerts. It does not by itself triage or respond; someone has to run it.
• A SOC is the people, process, and technology that use tools like a SIEM to detect and respond.
• MDR (managed detection and response) is a service that combines technology and a provider's analysts to detect threats and take or recommend response actions, usually with direct involvement in containment.

For a deeper comparison, see MDR vs SIEM.

What a good managed SOC provides {#capabilities}

• Genuine 24x7 monitoring with live analysts, not only automated alerts.
• Correlated detection across multiple signal types — endpoint, network, identity, and cloud — so related alerts become one incident.
• Response, not only notification, with agreed playbooks and clear rules about which actions the provider can take and which need your sign-off.
• Threat intelligence and detection tuning for your environment.
• Clear reporting — incidents, trends, and metrics — for management and auditors.
• Evidence for compliance, including a record of each incident and its resolution.
• Escalation paths and named contacts.

Questions to ask a provider {#questions}

1. Are analysts live and on shift around the clock, or is overnight coverage automated or on call?
2. What data sources do you ingest, and how long does onboarding take?
3. What can you do automatically in a response, and what requires our approval?
4. How do you correlate signals across endpoint, network, identity, and cloud?
5. What are your service levels for acknowledging and escalating an incident?
6. Where is our data stored and processed, and who can access it?
7. How do you help us meet reporting duties, including CERT-In's six-hour rule?
8. What reports and compliance evidence do we receive?
9. How do you handle a major incident — do you provide forensic and recovery support, or hand over to someone else?
10. What happens at the end of the contract — how do we get our data and detections back?

Indian regulatory context {#india}

• CERT-In — CERT-In's April 2022 directions require covered entities to report specified cyber incidents within six hours of noticing them and to retain ICT system logs for 180 days. A SOC that already collects and retains logs and can investigate quickly makes both easier to meet.
• Sector regulators — banks, insurers, and market participants have their own monitoring and reporting expectations. See Cyberattacks on Indian Banks and SEBI CSCRF and VAPT.
• DPDP Act — breach notification duties require quick detection and assessment. See Data Breach Response Under DPDP.
• Scale of the threat — CERT-In reported handling over 29.44 lakh cyber incidents in 2025.

Measuring a SOC {#metrics}

Useful measures include mean time to detect and mean time to respond, the share of alerts triaged within target, false-positive rates, coverage of critical assets by detection, and the number and severity of incidents. Beware vanity metrics such as raw alert counts: what matters is how quickly real incidents are found and contained.

How Threat ResQ's SOC+ fits {#soc-plus}

SOC+ is Threat ResQ's managed detection and response platform. Its published capabilities include 24x7 monitoring and alert triage by a live analyst team; correlated detection across endpoint, network, and identity signal; automated response playbooks with analyst sign-off; and a direct signal exchange with DomainShield IQ and TRISA, so external risk findings and human-risk signals appear in the same queue as technical alerts. Each incident and its resolution is logged automatically as compliance evidence for getTRAC. SOC+ is not fully automated — automated correlation and playbooks handle the volume, and a live analyst team makes the response call. Threat ResQ's Incident Response service provides on-call containment, forensic investigation, and recovery support when an incident is declared.

FAQ {#faq}

What is SOC as a service? A model in which a provider runs security monitoring, detection, and response for your organization from its own security operations centre, instead of you building and staffing one.

What is the difference between a SOC and a SIEM? A SIEM is a tool that collects and correlates logs and raises alerts. A SOC is the team, processes, and tools that use it — and others — to detect, investigate, and respond to threats.

What is MDR? Managed detection and response: a service combining technology and a provider's analysts to detect threats and take or recommend response actions, with direct involvement in containment.

Does a managed SOC help with CERT-In reporting? It can. CERT-In requires specified incidents to be reported within six hours of noticing them and ICT logs to be kept for 180 days; a SOC that collects logs and investigates quickly helps you detect, assess, and report within those limits.

Is a managed SOC fully automated? It should not be. Automation handles volume, but analysts should investigate and make response decisions, especially for anything affecting business operations.