Un SOC matur nu inseamna 10 ecrane si 20 analisti. Pentru SMB / mid-market, un SOC functional 24/7 se construieste cu stack open-source si automatizare.
Stack-ul implementat
- Wazuh SIEM — agregare loguri, corelare evenimente, detectie anomalii cu rules + ML
- Suricata IDS/IPS — inspectare trafic in timp real, Emerging Threats + custom rules
- Snort 3 — secondary IDS cross-validation
- CrowdSec — community threat intelligence, blocaj automat
- Grafana + Loki — dashboards centralizate, log aggregation
- TheHive + Cortex — incident case management
- Alerting — Telegram, email, PagerDuty cu on-call rotation
Ce inseamna "24/7" real
Nu oameni treji 24h. Inseamna: detectie 24/7 (automata), triaj 24/7 (severitate, runbook automat), response uman <15 min pentru P1/P2 via on-call rotation. P3/P4 - next-business-day.
Procesul de incident
Detectie → corelare Wazuh → ticket TheHive → notificare on-call → triaj 5 min → escalare/rezolvare/inchidere. Tot procesul documentat in runbook-uri specifice per tip incident.
Diferenta de MSSP comercial
Cost predictibil (fara surprize per-eveniment), transparenta completa (vezi ce vede analistul tau), zero black-box (rules vizibile si ajustabile), portabilitate (poti lua stack-ul oricand).
Ce livram
SOC functional 24/7 cu run-books pentru top 20 scenarii, dashboard custom, training echipa, integrare cu sistemele existente.