Managed SOC and MDR, at three levels
Dottor Marc's Security Operation Center watches your systems, filters out the noise and, if you choose, acts on alerts and leads the incident response, during business hours or around the clock.
An external SOC, without building one in-house
A Security Operation Center (SOC) is the group of analysts who watch over a company's systems every day, read the alerts, tell the real ones from the false ones and decide what to do. SOC as a service is the same thing provided by a specialist company: you do not hire the team, buy the tools or organise the shifts.
Managed Detection and Response (MDR) is the next step. We do not just report a problem to you: alerts go to our SOC and the team steps in to contain the threat and start the incident response.
Within Dottor Marc there is a SOC with a team of experts who organise and run the proactive services of Dottor Box. You can entrust it with monitoring alone, or with the response too, during business hours or at any hour. There are three levels, and each one includes the one before.
With the MDR levels, the incident has someone in charge and it is the provider: Dottor Marc takes on the role of Incident Response Team Lead.
Security Monitor, MDR + SOC and MDR + SOC 24/7 compared
Three cumulative levels: what changes is how much you delegate to our SOC and at what hours. The detail of what each one includes is on the platform page.
| Aspect | Security Monitor | MDR + SOC | MDR + SOC 24/7 |
|---|---|---|---|
| What it is | The platform and continuous monitoring | Adds detection and response managed by us | The same cover, at any hour |
| Who acts on findings | Your company, with our reports and alerts | Our SOC acts on alerts | Our SOC acts at any time |
| Support | Reports, alerts and portal | 8/5 tickets, during business hours | Dedicated phone number, 24 hours a day, 7 days a week |
| Role in the incident | Your company leads the response | Dottor Marc is Incident Response Team Lead | As MDR + SOC, with round-the-clock availability |
| Who it is designed for | Organisations with in-house IT that can act on findings | Organisations that want an external team working alongside them | Organisations that cannot afford prolonged downtime |
Frequency. The scheduling of checks is configurable, and the contractual service level is the minimum commitment. Packages of remote consulting hours are purchased separately.
What Dottor Marc's SOC actually does
Tools produce events. The value lies in the people who read them and decide which ones matter.
False positive management
Alerts are reviewed and cleaned up, so that the notifications you receive are accurate. An alarm that is always ringing soon stops being listened to.
Threat hunting
Proactive hunting for hidden threats: analysts look for traces of compromise that no alert has yet flagged.
Predictive analysis
Correlating security data produces signals to prevent incidents, technology failures and operational stoppages before they happen.
Service continuity
The SOC checks that the checks keep running: a sensor that has gone silent must not be mistaken for a quiet network.
Vulnerabilities and patches
With MDR, the SOC follows up notified vulnerabilities and available patches and takes action to resolve them, coordinating with your suppliers.
Policies and procedures
What is seen during monitoring gives rise to concrete proposals for updating security policies and procedures.
8/5 tickets and guided incident response
At the MDR + SOC level, requests go through a ticketing system during business hours, five days a week. Every ticket is classified by urgency and severity, so an incident in progress does not sit in the queue behind a configuration question.
- prompt response and proactive communication on progress;
- documentation of the actions taken, which remains as evidence;
- identification of recurring problems, to arrive at preventive solutions;
- coordination with external suppliers when needed, including those in your supply chain.
Who leads when it happens
The CSIRT is your company's incident response team: in Dottor Box you build it by assigning people to fifteen roles already in place, in the Incident Response and data breach register module.
With the MDR levels our SOC works with your CSIRT on reported incidents and Dottor Marc takes on the role of Incident Response Team Lead. You do not have to improvise a coordinator with systems down: there already is one, and they know your systems because they monitor them every day.
The event register follows the incident phases, from detection to lessons learned, which also helps with any data breach notification within 72 hours.
A 24/7 SOC for SMEs that cannot stop
Attacks do not keep office hours, and many start at night or at the weekend for exactly that reason. The MDR + SOC 24/7 level brings round-the-clock security monitoring: continuous monitoring and incident response, 24 hours a day, 7 days a week.
You have a dedicated phone number for emergencies and a team that is always operational, working to procedures already agreed and tested with your company. Whoever answers at three in the morning already knows whom to call at your end, and what can and cannot be switched off.
- Business continuity as a stated objective
- The risk of prolonged downtime kept as low as possible
- A SOC kept constantly up to date on new threats
- A high level of compliance with security and data protection rules
- Everything included in Security Monitor and MDR + SOC
Why an external Security Operation Center
Building an in-house SOC means choosing and maintaining a SIEM and XDR, hiring analysts in a market where they are scarce, training them continuously and, to cover nights and holidays, organising shifts with several people. For an SME it is rarely sustainable.
With an external SOC the sums change: the tools are already in the platform, the experience is that gained across many different infrastructures, and you pay according to the assets monitored, not the number of employees. You still decide how much to delegate, starting from Security Monitor and moving up a level when you need to.
The provider, Dottor Marc S.r.l., is certified to ISO/IEC 27001 and ISO 9001: it is subject to the same controls you require of your ICT suppliers. If you are looking into this for your company, start from the page on cyber security for SMEs.
Honest about what a SOC can do
No serious provider can tell you that you will never be attacked. A SOC shortens the time a threat stays invisible, limits the damage and leaves you with documentation of what was done.
- The SOC finds, measures and documents: it does not make an attack impossible.
- Automatic responses on endpoints are agreed beforehand, they do not fire by surprise.
- Blocking a Microsoft account is never automatic: a person always confirms it.
- Support covers the platform and the services, not the maintenance of your computers.
Which standards it supports
Monitoring, incident handling and recording of actions are measures required by NIS2, ISO/IEC 27001 and the GDPR. The SOC's work leaves the evidence you need for NIS2 compliance.
Questions about SOC as a service and MDR
What is the difference between a SOC and MDR?
The SOC is the structure: the people and processes that watch over security. MDR is a service that structure delivers: as well as detecting threats, it steps in to contain them and leads the response. In Dottor Box, Security Monitor already includes the SOC's work on the data collected, while the MDR levels add action on alerts and the role of Incident Response Team Lead.
Does an SME really need a 24/7 SOC?
It depends on what downtime costs you. If production or online services going down overnight would have a serious impact, the 24/7 level with a dedicated number makes sense. If your activity is concentrated in office hours, the MDR + SOC level with 8/5 tickets may be enough. A specialist will help you choose based on how your company works.
Does the SOC service replace my IT department or my IT provider?
No. The SOC deals with security: monitoring, alert analysis, threat hunting and incident response. Day-to-day management of your systems stays with whoever does it today, and our SOC coordinates with your IT team and external suppliers when needed.
What needs to be installed to activate the MDR service?
It depends on the checks you choose. To see endpoints you need the Cyber Agent on PCs and servers; for the internal network, the Cyber Drill probe; for the external network, nothing at all. Installation on your devices is included in the service. The steps are described in how it works.
Does the SOC help with the incident notification required by NIS2?
The SOC detects and analyses the incident and, with the MDR levels, leads its handling as Incident Response Team Lead. The phases and actions are documented in the event register, which is the basis for the information to be reported. Notifying the authority remains your organisation's obligation.
What the SOC works on
Managed SIEM and XDR
Centralised logs, event correlation and endpoint response, with analysts who filter out the noise.
Learn more SeeCyber Agent
The endpoint agent: security events, file integrity and clear, readable alerts.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.