24/7 MANAGED SOC & MDR
A human analyst on every alert, day and night
Managed SOC and MDR for mid-market companies in Israel, Mexico and Europe. Proven EDR and SIEM detection, triage in under 15 minutes, and a named analyst who calls you.
How the SOC works
From raw events to a phone call
Detection runs on proven EDR and SIEM platforms. Cybool analysts in Tel Aviv do the triage, the containment and every conversation with your team.
- events / day
- 8.6M
- events / day
- alerts
- 312
- alerts
- incidents
- 26
- incidents
- escalations
- 2
- escalations
Collect
Endpoints, cloud accounts, identities and mailboxes stream telemetry to the SOC around the clock.
Detect
Correlation rules and threat intel turn millions of events into a short list of alerts worth a human look.
Triage
An analyst reviews every alert, target under 15 minutes, and separates noise from a real intrusion.
Respond
We take the containment steps you approved, then your named analyst calls you and follows up in writing.
What we monitor
What is included in CyberSOC 24/7
- Real-time threat detection
- Continuous monitoring of endpoints, networks and cloud environments, with detections tuned to your infrastructure.
- Endpoint & identity security
- EDR/XDR with identity threat detection and response (ITDR) to stop credential-based attacks.
- SIEM log correlation
- Centralized logging and correlation across your infrastructure for threat hunting.
- Incident response workflow
- Pre-agreed containment playbooks and analyst-led investigation when a threat is confirmed.
- Monthly reporting
- Threat summaries, incident history and security posture metrics every month.
- 24/7/365 Coverage
- Round-the-clock monitoring, weekends and holidays included.
SOC in numbers
What you get, stated plainly
- Alert triage target, day and night
- < 15 min
- Monitoring, weekends and holidays included
- 24/7/365
- Named analyst who knows your environment
- 1 analyst
- Default location for your security data
- EU
Response times are operating targets, not contractual SLAs. Contractual terms are set in your service agreement.
"We already have Defender."
Good. Keep it. Here is what it does not do.
Microsoft Defender, like any EDR, raises alerts. Someone still has to read them at 3 a.m., decide which one is an attacker and act.
| Cybool SOC | Defender alone | Typical MSSP | |
|---|---|---|---|
| Human triage of every alert | IncludedUnder 15 min, 24/7 | Not included | PartlyOften queued |
| Calls you at 3 a.m. | Included | Not included | PartlyUsually a ticket |
| Containment | IncludedSteps agreed in advance | PartlyAutomated rules only | PartlyVaries by contract |
| Named analyst | Included | Not included | Not included |
| Full data export at exit | Included | Not included | PartlyVaries by contract |
Case timeline
12 minutes from signal to containment
A mid-market company, a stolen VPN login and a ransomware crew preparing to encrypt.
02:31VPN login outside the user's normal pattern raises an alert
02:35 – 02:46Attacker enumerates Active Directory and backups; SOC correlates the chain
02:47PowerShell disables Defender: host isolated, VPN cut, account disabled
02:47 – 02:59Named contact called; CISO on the phone with the analyst
02:59Containment verified. No files encrypted
Method: times from the SOC case log. Elapsed time runs from the first containment-eligible signal (02:47) to verified containment (02:59). Client details anonymized.
Read the full timelineFAQ
The questions buyers actually ask
We already have Microsoft Defender. Why do we need you?
Defender raises alerts. Someone still has to read them at 3am, decide which one is an attacker and act. That is the service: a human analyst triages every alert within 15 minutes, takes the containment steps you approved in advance, and calls you.
Are we too small to be a target?
Ransomware groups do not filter by company size. Our live ransomware map shows hundreds of new victims every month across every sector. Size mostly decides how long an attacker goes unnoticed.
What does it cost?
Business is quoted per endpoint and Email & GRC per user, after a short call. Enterprise is priced to scope.
How long is the contract, and can we leave?
The minimum term is 12 months, billed monthly. You can leave with 60 days' notice, and we hand over a full export of your data with no exit fee.
Who actually watches our alerts?
Detection runs 24/7 on proven EDR and SIEM platforms. Cybool analysts handle triage, escalation and every conversation with your team, and you get a named analyst who knows your environment.
Where is our data stored?
In the EU by default.
How fast do you respond?
Our target is human triage of every alert within 15 minutes, 24/7/365. It is an operating target, not a contractual SLA. Contractual terms are set in your service agreement.
Is Cybool ISO 27001 certified?
No, Cybool is not ISO 27001 certified today. Our team holds ISO 27001 Lead Auditor certification and runs ISO 27001 programs for clients.
Are you local to us?
Our analysts are based in Tel Aviv, Israel, and we work with companies in Israel, Mexico and Europe, in English, Spanish and Hebrew.
Also from Cybool: Penetration testing, GRC consulting and Email security.
Put an analyst on your alerts
Talk to a Cybool analyst about your environment, or start with a free external exposure scan.
Talk to an analyst