What happens when a managed SOC detects an attack?

When a managed SOC detects an attack, an analyst first triages the alert to confirm it is a real incident. The SOC then applies the first containment actions it is authorised to take, such as isolating an endpoint or blocking an account, and alerts the MSP or client according to the agreed procedure. If the attack is serious, an incident response team takes over.

This article is part of our series on managed SOC. For the general principle, see SOC for MSP: what it is and how it works.

Step 1: detection

A rule or behavioural analysis raises an alert: a suspicious process on an endpoint, an abnormal Microsoft 365 sign-in, an unusual mail forwarding rule. At this stage it is only a signal. See What does a managed SOC monitor?.

Step 2: triage

An analyst reviews the alert in context: is the user travelling? Is this software normally used? Do other signals line up? The outcome is one of:

• false positive: the alert is closed and the rule tuned if needed;
• suspicious activity to confirm: the analyst asks the MSP for information;
• confirmed incident: move to containment.

This is where a SOC earns its keep: without it, the MSP receives raw alerts it has no time to handle.

Step 3: containment

The aim is to stop the attacker’s progress as fast as possible. Typical actions:

• isolating the endpoint or server from the network through the EDR;
• disabling the compromised account and revoking its sessions;
• deleting a malicious mail rule;
• blocking an address or domain on the firewall.

These actions are agreed in advance with the MSP: some are immediate, others need approval. See Managed SOC and MSP: who does what?.

Step 4: escalation

The SOC alerts the agreed contacts with a clear message: what happened, what has been done, what remains to do. The procedure sets who to call depending on severity, including at night and at weekends.

Step 5: incident response

For a serious incident (ransomware, widespread compromise), more is needed: understanding how the attacker got in, what they touched, whether they are still present, then rebuilding cleanly. That is the job of an incident response team, often called a CERT. At Cyna, incident response is handled by its CERT, a member of InterCERT France, which works with the SOC teams and can be mobilised quickly. The incident response on-call team is available 24/7 from the Report an incident page. See What is included in a managed SOC?.

Step 6: report and lessons learned

The incident closes with a report: timeline, root cause, impact, actions taken, recommendations. It is used to fix weaknesses, inform management and, where relevant, prepare regulatory reports. For a significant incident, Article 23 of NIS2 provides for an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.

What drives response speed

• Integrations that allow action: a SOC that cannot isolate an endpoint through the EDR has to wait for someone else to do it.
• An up-to-date escalation procedure: contacts, numbers, decision rights.
• Pre-authorised actions: every minute spent seeking approval gives the attacker time.

To see this sequence in a real scenario, watch our live demo of the first minutes of a cyberattack.

Talk to an expert

Want to build or test your escalation procedure? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Can the SOC act without asking permission?

Only within the scope agreed at onboarding. You agree in advance which actions are automatic or immediate (isolating an endpoint, disabling an account) and which need the MSP's or client's approval.

Who gets called at night or at weekends?

The on-call contacts set out in the escalation procedure: usually the MSP, plus a client contact for serious incidents. Test this before you need it.

Does the SOC report the incident to the authority for me?

Under Article 23 of NIS2, notification is made by the entity concerned. The SOC can provide useful elements (timeline, impact, indicators) to help prepare it. See Does a managed SOC help with NIS2?.

How long does incident response take?

From a few hours for a quickly contained compromised account to days or weeks for widespread ransomware. Speed of detection weighs most on that duration.

Will the attacker notice they have been detected?

Sometimes. That is why containment actions are coordinated: isolating several endpoints and disabling accounts at once avoids giving the attacker time to react.