From our İstanbul SOC we monitor your logs, endpoints and cloud telemetry 24/7, detect threats and respond to them.
From 38,000 TRY per month
Many organisations generate alerts but lack the capacity to review them around the clock. Surnet SOC collects logs from SIEM, EDR/XDR, firewalls, e-mail and cloud (Microsoft 365, AWS, Azure) on one platform, analyses them with detection rules and separates real threats from false alarms.
Scope
- 24/7 alert triage and incident response (MDR)
- Detection rules mapped to MITRE ATT&CK and threat hunting
- Containment actions: host isolation, account lockout and IP blocking
- Monthly executive report and quarterly tabletop exercise
Service level
First response is 15 minutes for critical alerts and 30 minutes for high severity. False-positive rate, mean time to detect (MTTD) and mean time to respond (MTTR) are reported. Data is held in data centres in Türkiye.
Scope of service
- 24/7 alert triage and MDR
- MITRE ATT&CK-mapped detection
- 15-minute critical response
- Data stays in Türkiye
Managed SOC & MDR (24/7) — get a quote
Fill in the form and we will get back to you as soon as possible.
Frequently asked questions
What is a SOC service and how does it differ from building our own team?
True 24/7 monitoring needs a shift team of at least 8–10 people, a SIEM licence and detection engineering. A managed SOC provides this capacity on a shared basis; setup drops from months to weeks and cost is typically a third of an in-house team.
Will a penetration test affect our live systems?
Tests follow the rules of engagement approved in the scoping document. Destructive techniques (DoS, data deletion) are not used; risky actions are announced in advance and preferably performed in a maintenance window.
How long does a penetration test take?
A mid-sized web application takes 8–10 working days, a corporate internal network test 10–15. The report is delivered within five working days of test completion; retesting after fixes is included.
What should we do in a KVKK breach?
A data breach must be notified to the Personal Data Protection Board within 72 hours of becoming aware, and to affected individuals within a reasonable time. If you reach us through the incident form we manage forensics and the legal notification together.
Should we pay the ransom after a ransomware attack?
Payment guarantees nothing and encourages attackers. First isolate, verify backups and check for decryptors. The decision belongs to senior management after a legal and business-impact analysis; we provide technical and strategic advice.