MANAGED SOC · 24×7×365

Detect.Respond.Protect.

A managed SOC that handles incidents, not just alerts on them.

SOC · LIVE

02:14:07SIEMbrute-force detected · VPN

02:14:08XSOARincident opened HIGH

02:14:08AI-TRIAGEauto-enrich · IOC lookup

02:14:09PLAYBOOKblock source IP · isolate endpoint

02:14:11ANALYSTverified · contained

02:14:12SLACKclient notified · action logged

02:14:12MARAincident closed · report available

Illustrative scenariodetect → respond → report

Thursday · 02:14

Someone is trying to log in to your VPN for the 400th time.

The question isn't if it will happen.
The question is who will see it, and how fast.

02:14At your organization, who is awake right now?

Before we start

Before we present, we'd like to understand you

?

Who handles alerts today, and what happens outside working hours?

?

Which systems are critical to you, and where do the logs come from?

?

Which regulatory or audit requirements do you need to meet?

?

What was the last incident that worried you, and how was it handled?

Five minutes of conversation here are worth more than any slide that follows.

What we see in the field

The problem isn't the tools. It's what happens between them.

01

More tools ≠ more protection

Every system adds alerts. Without someone connecting and filtering them, you get more noise, not more protection.

02

A SOC that forwards alerts forwards responsibility

A service that says "there's an incident" and leaves it to you doesn't solve the problem. It just hands it back to you.

03

24/7 is math

168 hours a week. Real coverage takes 5–6 analysts on shifts, before tools, training and turnover.

Think about it

5 questions to ask every SOC provider (including us)

01

When an incident is detected, do you get an alert, or does someone handle it?

02

What are you paying for: every data source and every rule, or an outcome?

03

Is your data in a dedicated, isolated environment, or shared with other customers?

04

If you leave the provider tomorrow, what stays with you?

05

How do you reach an analyst at 3 AM: a ticket in a queue, or a direct conversation?

Our approach

A SOC isn't a product.
It's a commitment to an outcome.

We monitor, detect and respond, and you hear from us only when it really matters.

Trusted by

Some of our clients

2012Active since24/7SOC on duty100sClientsPSOfficial partner

CalClarotyEnlightPassportCardEnforcement & Collection AuthorityDexcelPixellotTaglitAitechEshFridensonSol-GelCaesareaRiseUpRetymHashmal YashirART MedicalServ-U CloudLevy ShtarkPsiphasAD120

Finance & insuranceGovernment & public sectorCyber, technology & defenseHealth & pharmaEnergy & infrastructureand hundreds more

What you get · in plain words

What you get, in plain words

Eyes on your organization 24/7/365

A SOC team watching all your systems: nights, weekends and holidays.

Handling, not just alerting

We investigate, block and contain the incident, not just tell you there's a problem.

Updates only when it matters

A dedicated Slack channel: what happened, what we did and what we need from you, with one-click actions.

Full transparency

The MARA portal: every incident, action and report, available to you at any moment.

Committed response times

SLA by severity: 10 minutes for a critical incident.

A system that improves, and stays yours

Detection and reports keep getting sharper. If you leave, every setting and all the knowledge stay with you.

Same night · at Sysec

And what happens at Sysec at 02:14?

02:14

Detection

The SIEM spots a pattern of abnormal login attempts and correlates events from different sources.

+1 min

Automatic enrichment

An incident opens. AI checks IP reputation, the users involved and history.

+3 min

First response

A playbook blocks the source address automatically, per a policy agreed with you.

+7 min

Analyst verifies

An expert analyst reviews, confirms and isolates the endpoint if needed.

+10 min

You're informed

A Slack message: what happened, what we did, what we need from you.

08:00

Morning

A full report in MARA, and the rule is tuned to detect faster next time.

Illustrative scenario · actual response times are set in the SLA by severity

Sysec AI-Driven SOC · SOC as a Service + MDR

Behind the scenes: how it works

01

CUSTOMER ENVIRONMENT

NetworkFirewalls, VPN, IDS/IPS, DNS

EndpointsServers, Laptops, Workstations

CloudAWS, Azure, GCP, SaaS

IdentityAD, Entra ID, Okta, Auth logs

ApplicationsWeb, DB, ERP, Custom apps

Email & CollabMicrosoft 365, Gmail, Slack

Data SourcesDB, File servers, Backups

IoT / OTNetwork devices, Industrial

DATA
COLLECTION

Secure collectors
Agents · APIs

CENTRAL SIEMMulti-platform

Log Ingestion

Normalization

Correlation

Analytics

Centralized Log Storage

XSOARCortex

Alert Ingestionfrom SIEM

Direct IntegrationsEDR / XDR

Automation& Orchestration

Playbooks& Response

AI + HUMANINVESTIGATION

AI AgentsEnrichment & Analysis

SOC AnalystsInvestigation & Decision

RESPONSE &OUTCOMES

Automated Response

Remediation& Containment

NotificationsSlack · Teams · Email

Ticketing& Documentation

ReportingMARA Dashboards

SYSEC 24/7 SOCMonitoring · Detection · Response

SECURITY PRODUCTS direct alerts ↑

EDR / XDRNDREmailCloudNetwork

INFRA AWS · Azure · On-Prem · Hybrid · Multi-Cloud VPN / TLS / Private Link Scalable · Secure · Resilient DETECT. INVESTIGATE. RESPOND.

Technology ecosystem

We work with the leaders, and with what you already have

Cortex XDR · XSIAM · XSOAR

Falcon EDR · Next-Gen SIEM

SentinelOne

Singularity XDR · AI SIEM

Defender XDR · Sentinel

SIEM · Observability

234+integrations; in short, we work with anything

FirewallEmail SecurityIdentity / IAMCloud · SaaSNDROT / IoTVuln Mgmt+ more

Official PS partner of several leading vendors: we deploy, not just monitor.

In action

This is what it looks like in action

MARA by Sysec

People + AI

Smart automation. Human judgment.

IN SECONDS

AI & automation

Check and enrich every alert
Filter noise and false positives
Run immediate response actions

24/7

Expert analysts

Verify, investigate and prioritize
Contain and document the incident
Reachable directly, no queues

WHEN IT GETS DEEP

PS expert team

Deep, complex investigations
Certified SIEM and XDR experts
Improve detection over time

What can be automated runs immediately. What needs judgment goes to a person.

Back to the 5 questions

Remember the 5 questions? Our answers.

Common market modelSysec

01 · IncidentAn alert is passed to youFull MDR: investigation, containment and documentation

02 · PricingBy sources, rules or EPSBy data volume, with unlimited sources and rules*

03 · EnvironmentA SIEM shared by several customersA dedicated, isolated SIEM per customer

04 · ExitThe knowledge stays with the providerThe settings, rules and knowledge are yours

05 · CommunicationTickets and queuesTwo-way Slack with a live analyst 24/7

* Subject to technical review and approval · "Common market model" describes things worth checking with any provider

Service level

A commitment, not a promise

CRITICAL

10min

Active threat / broad impact

Immediate detection and response

HIGH

1hour

Significant threat

Fast, documented handling

MEDIUM

6hours

Suspected anomalous activity

Investigation and enrichment

LOW

12hours

Informational alert

Review and documentation

Availability 24/7/365 · response time is measured by incident severity

Value around the table

What it means for everyone around the table

CISO

Peace of mind and control

Full visibility, timely response and expert backup in a complex incident.

Management & finance

Predictable cost

No 24/7 hiring, no surprises on the invoice, no vendor lock-in.

IT

Less noise

You get only what needs you, with full context and one-click actions.

Regulation & audit

Everything documented

Continuous monitoring, full documentation of every incident and regular reports.

Bottom line: you focus on the business; we focus on protecting it.

After the "yes"

What happens once we start

01

Scoping & mapping

We sit together: systems, risks and regulatory requirements.

02

Connect

We connect the data sources and set up a dedicated environment.

03

Tailor

Rules, playbooks, and who gets what and when.

04

Full monitoring

24/7, ongoing reporting and continuous improvement.

What do we need from you?One point of contactAccess to the log sourcesOne scoping meetingWe do everything else.

Service tracks

Start where it's right for you

ESSENTIAL

Monitoring & detection

24/7 monitoring on a dedicated SIEM
Tailored detection rules
Alerts and regular reporting

ADVANCED

Monitoring & response

Everything in Essential
Incident handling and automation
MARA portal and Slack

FULL MDR

Full MDR 24/7

Everything in Advanced
Investigation, documentation and containment
Backup from the PS expert team

Simple pricing: by daily data volume not by the number of systems. Details in your tailored proposal.

Next step

Our offer: a posture review with no commitment.

1

Mapping

Which systems are monitored today, and where the visibility gaps are.

2

Recommendations

A concrete, prioritized list of what to improve.

3

Tailored proposal

A track and pricing that fit you: transparent and detailed.

So who will see your next alert?

office@sysec.co.il sysec.co.il

Appendix · 12 differentiators

Appendix: 12 things that set our service apart

01

SIEM as SaaS

Cloud-deployed and fully managed by Sysec: no on-prem infrastructure, with updates and scalability.

02

A dedicated SIEM per customer

A fully separate, isolated environment: full performance and stronger security.

03

Proactive handling

Even non-critical alerts are reviewed and improved: less noise, more accurate detection.

04

Escalation to the PS team

Deep investigations go to certified SIEM and XDR experts.

05

Continuous system development

Rules, reports and sources are refined throughout the service, not just at onboarding.

06

Full MDR + investigation

Not just monitoring: investigation, documentation and containment, with analysts available 24/7.

07

Full data ownership

Settings, rules and the knowledge base stay with you. No vendor lock-in.

08

Unlimited sources*

Connect as many sources as you like at no extra cost. More connections, more visibility.

09

Unlimited correlation rules*

Every rule tailored to your environment, with no cap and no extra charge.

10

Commercial flexibility

From an essential track to full 24/7 MDR, matched to your needs and budget.

11

Two-way Slack

Alerts, one-click actions (block, isolate, approve) and a live analyst, with no tickets.

12

Automatic IOC updates

From leading intelligence sources, the Israel National Cyber Directorate and open feeds.

* Pricing is by daily data volume, not the number of systems · rules subject to technical review and approval