The analyst portal
Incidents with a clock for every severity, hunting across every customer in KQL, on-call by mail and push, a mobile app, and the handover written down.
The analyst portal, customer portal and orchestration platform
One place for the analysts who watch one organisation or many: every incident, every hunt, every handover.
Three in one
One product, three audiences
The customer portal
Each customer signs in to a view of its own: its incidents as they are worked, and branded weekly, monthly and yearly reports, also as PowerPoint.
The orchestration platform
Every SIEM instance is managed from here: scaling, draining and enrolling nodes, each change approved by a second administrator.
What it does
Where detection becomes response
An alert is only worth something when a person can act on it in time. Eagle SOC is built around that person.
- Incidents with clocks. Alerts grouped by entity, SLA timers, triage states, a timeline and suppression.
- Hunting that becomes detection. A library of hunting queries, and any query can become a rule after a backtest against the last seven days.
- Across every customer. One hunt, run over all the instances an operator looks after.
- On call, in the pocket. On-call rules by mail and push, and a mobile app for whoever holds the shift.
- The handover written down. What is open, what was decided, and what the next shift inherits.
- For the customer too. Branded weekly, monthly and yearly reports, and a portal where customers follow their own incidents.
- One question, every customer. When a vulnerability makes the news, the SOC asks the scanners which customers it touches and has the answer from their own data.
- Runs the estate. Every SIEM instance is managed from here: scaling, draining and enrolling nodes, each change approved by a second administrator.
In the suite
What reaches the SOC, and how
Eagle SOC never reaches into a customer's network. Everything it sees arrives through one door, or directly from a service the customer already has.
Eagle SOC Secure
The gateway in front of the SOC. Every customer's SIEM connects here, and nowhere else.
Eagle SOC SecureEagle SIEM
One instance for each customer, on the customer's premises. The SOC searches it where it stands, and the log data does not move.
Eagle SIEMMicrosoft Sentinel and Defender
Incidents from the customer's own Microsoft Sentinel, and incidents and alerts from Microsoft Defender, come directly to Eagle SOC and are worked beside the rest.
Eagle ScanV
When a vulnerability makes the news, the SOC asks the scanners which customers it touches, and the customer's report carries the findings and the plan to fix them.
Eagle ScanV
Good to know
Before you ask
Three service levels
Essential, Standard and Enterprise. A customer is onboarded from the portal at the level it has agreed.
Four eyes
The changes that matter are proposed by one person and approved by another before anything happens.
AI without the names
Where a language model helps an analyst, what it is given is pseudonymised first.
Eagle SecOps Suite
One part of one system
Eagle SOC is part of the Eagle SecOps Suite: governance, detection, monitoring, vulnerability scanning and secure DNS, built by one team to work as one.
See Eagle SOC running
An hour with the people who built it, on a real system, with your questions. No slideware.