24×7 UK SOC, delivered through our group SOC365.
Group-operated SOC providing SIEM, network monitoring, threat detection, incident response and managed EDR. In-house, delivered as SOC365 Services — fully transparent.
What we mean by SOC as a Service
SOC as a Service is continuous monitoring of your environment by a Security Operations Centre that is somebody else’s staffing problem. Logs come in, alerts go out, analysts triage and act. The point is that you get 24×7 coverage without having to recruit twelve analysts and stand up a SIEM platform.
Our group’s SOC, branded SOC365, is operated as SOC365 Services — our branded 24×7 SOC capability within the 1 Sequence group. In-house, 24×7/365. The contract is with 1 Sequence Cyber; the analysts watching your environment sit in the group SOC. We disclose the relationship up front because the alternative is opaque.
Key facts
- In-house cover
- 24×7
- Capability areas
- 6
- SOC location
- UK
- Delivery model
- Group
What we do
Four service pillars, delivered continuously rather than as point-in-time engagements.
24×7 monitoring
Continuous monitoring of in-scope systems with rotating shifts. In-house analyst rota, no offshore handover.
Threat detection & triage
Detection coverage informed by NIST CSF 2.0, ISO/IEC 27035-1:2023 and the MITRE ATT&CK Enterprise matrix.
Incident response
In-band incident response from the same SOC team. Hands off cleanly into our retainer IR service when an event escalates.
Weekly & monthly reports
Generic reporting cadence with weekly and monthly reports. Output tuned to what your audit and board need.
How an engagement runs
Five stages from first call to steady-state. Onboarding is the workload; everything after is monitoring, response and review.
- 1
Scoping call
30 minutes, freeEndpoint count, log sources, on-call expectations, and reporting needs. Output is a written scoping draft.
- 2
Onboarding
2–4 weeksLog-source connections, baseline tuning, agreed runbook handover. We work alongside your team to set thresholds rather than dropping in defaults.
- 3
Steady-state monitoring
Continuous, 24×7/365Group SOC365 watches your environment. Analysts work in rotating shifts with full handover logging between shifts.
- 4
Detection & response
Per eventTriage by SOC analysts. Response actions per the agreed runbook — escalation to your team, automated containment, or full IR handover where warranted.
- 5
Reporting & review
MonthlyWeekly and monthly reports. Quarterly tuning review with your security lead. Detection content updated as your environment changes.
SOC capabilities
Six capability areas covered by SOC365. The same set published on the SOC365 Services product page — we do not invent capability descriptions the SOC does not deliver.
SIEM
Security Information and Event Management — log aggregation, correlation rules, alerting, and analyst-driven investigation.
Network Security Monitoring
Continuous traffic and flow analysis to identify anomalous behaviour, suspicious egress, and lateral movement.
Threat Detection
Detection engineering tuned to your environment. Coverage informed by MITRE ATT&CK Enterprise and ISO/IEC 27035-1:2023 principles.
Incident Response
Triage, containment recommendations, and escalation pathways. In-band response by SOC analysts; major incidents escalate to our IR retainer service.
Managed EDR
Managed Endpoint Detection & Response — endpoint telemetry collection, threat hunting, and response actions, governed by an agreed runbook.
Reporting cadence
Weekly and monthly reports covering activity, detections, false-positive rates, and tuning recommendations. Quarterly review of detection coverage.
Why 1 Sequence Cyber
Group-operated SOC, transparent disclosure
Our group's SOC, SOC365, is operated as SOC365 Services — our branded 24×7 SOC capability. In-house, 24×7/365. We are open about this because the alternative is opaque "in-house SOC" claims that hide the actual delivery model.
Standards-aligned, vendor-agnostic
Detection coverage informed by NIST CSF 2.0 Detect and Respond, the MITRE ATT&CK Enterprise matrix, and ISO/IEC 27035-1:2023 incident-management principles. We deliberately do not name SIEM or EDR vendors on this page — the right tool depends on your environment, not on what we are paid to push.
Frequently asked questions
Related services: incident response · phishing simulation · Penetration Testing.
Ready to scope SOC monitoring?
Tell us your endpoint count, your existing tooling, and what is driving the requirement. We’ll come back with a fixed-fee monthly proposal within 48 hours.
Back to all services.