What does a managed SOC monitor?

A managed SOC monitors your IT environment’s security events: endpoint and server activity reported by the EDR, Microsoft 365 sign-ins and mail activity, and firewall and remote access logs. It works from these traces, not from the content of your files or emails, looking for signs of an attack in progress.

This article is part of our series on managed SOC. For the general principle, see SOC for MSP: what it is and how it works.

Four main families of sources

Source	What reaches the SOC	Example attacks detected
Endpoints and servers (EDR)	Processes started, network connections, file and registry changes	Ransomware, attack tools, credential theft from memory
Identities (Entra ID, Active Directory)	Sign-ins, failures, permission changes, account creation	Sign-in from an unusual country, privilege escalation
Mail and collaboration (Microsoft 365, Google Workspace)	Mail rules, sharing, app consents	Mailbox compromise, payment fraud
Network (firewalls, VPN)	Inbound and outbound connections, remote access	VPN exploitation, traffic to a malicious server

Endpoints and servers: the EDR

The EDR (Endpoint Detection and Response) on endpoints and servers is the richest source. It records what happens on each machine and allows remote action, such as isolating a compromised device. That is why a managed SOC almost always relies on an EDR. See Do you need an EDR for a managed SOC?.

At Cyna, native integration covers SentinelOne and Microsoft Defender EDRs.

Identities and mail

Many attacks start with a compromised account, often after phishing. The SOC therefore watches sign-ins (location, device, repeated failures), permission changes and, in mail, the classic signs of compromise: an automatic forwarding rule to an external address, consent granted to an unknown app, mass file sharing. See Does a managed SOC monitor Microsoft 365?.

The network

Firewall and VPN logs show who comes into the network and what it talks to. They reveal exploitation of an internet-facing device or traffic to attacker infrastructure. At Cyna, connectors are ready for Stormshield and Fortinet firewalls, among others.

What the SOC looks for

The SOC does not react to every event: it looks for suspicious sequences. Typical examples:

• a successful sign-in from abroad right after a series of failures;
• an account that creates a mail forwarding rule, then sends unusual internal messages;
• an endpoint that runs a remote administration tool, then tries to connect to other machines;
• antivirus being disabled, followed by mass file encryption.

These are often weak signals, invisible to a single tool. We describe three of them in The 3 weak signals an EDR cannot see without a SOC.

Where to start

For most SMEs, a sensible order is the EDR on every endpoint and server, then Microsoft 365 or Google Workspace, then firewalls and VPN. Each new source should come with a check that its logs actually arrive and are complete, and with a review of the detection rules that use it.

What a managed SOC does not monitor

• File and message content. The SOC uses activity logs, not business data.
• Employee productivity. It is not an activity-monitoring tool.
• System availability. Whether a server is down is a job for IT monitoring, not the SOC. See SOC vs NOC: what is the difference?.

Log retention

Investigating an attack means going back in time. Retention depends on the SOC contract, but also on the sources themselves: Microsoft states that it keeps 180 days of audit records by default for most Microsoft 365 activities, unless a specific licence or policy applies. France’s national cybersecurity agency ANSSI recommends a logging policy that defines which events are collected and for how long.

Talk to an expert

Want to know which sources to connect first for your clients? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Does a managed SOC read employees' emails?

A managed SOC typically works from activity logs (sign-ins, mail rules, sharing, app consents) rather than message content. The exact scope is described in the contract.

Do all sources need to be connected from day one?

No. Most start with the EDR and Microsoft 365, which cover most attack scenarios, then add firewalls and other sources as needed.

Are industrial systems or IoT devices monitored?

Rarely in a standard offer. They need specific sensors and skills. If your business depends on them, ask explicitly.

How long are logs kept?

It depends on the SOC contract, but also on your licences: for example, Microsoft keeps 180 days of audit records by default for most Microsoft 365 activities. Longer retention makes investigations easier.

Does the SOC monitor remote workers?

Generally yes, when their devices run the EDR and they use Microsoft 365: monitoring follows the device and the account, not the office network. The scope is set in the contract.