Security services · Operations

Managed SOC & MDR, 24/7.

Our analysts watch your laptops, servers, cloud and network every minute of every day. When something is wrong, we do not just forward an alert: we investigate, contain the threat with actions you approved in advance, and tell you in plain words what happened.

Get a fixed-price quote
24/7/365 monitoringContainment, not just alertsLog retention planned for CERT-In and DPDP
SOC · sample night● demo
  1. FOUND Login from two countries 9 minutes apart
  2. BLOCKED Laptop isolated: ransomware behaviour
  3. FLAGGED New admin account created at 02:14
  4. FIXED MFA push spam stopped, password reset
  5. PASSED Monthly threat hunt: no persistence found
In plain words

A managed SOC (security operations centre), also called MDR (managed detection and response), is a team of security analysts who watch your systems around the clock, investigate anything suspicious and act on real threats. We bring logs from your laptops, servers, cloud, email and network into one place, filter out the noise, hunt for hidden attackers and, using actions you approve in advance, contain attacks before they spread.

Coverage
24/7/365
Watches
Endpoints · identity · cloud · network
Response times
Agreed in the contract
Pricing
Monthly, per endpoint
What a SOC does

From millions of events to the few that matter.

Your systems record millions of events a day. Almost all of them are harmless. A SOC finds the handful that are not, quickly, and acts on them.

Illustration of how a security operations centre filters activity: millions of events become hundreds of alerts, dozens are investigated by analysts, and a few real incidents are contained and reported. WHAT A SOC FILTERS · ILLUSTRATIVE MILLIONSEVERY EVENTLogins, file access, network traffic andcloud changes, all day, every dayHUNDREDSALERTSDetection rules and machine learningflag anything unusualDOZENSINVESTIGATEDAn analyst checks each one with context:who, what, where and how unusualA FEWREAL INCIDENTSContained with actions you approved inadvance, then reported in plain words
Illustrative volumes for a mid-sized company. The work of a SOC is the narrow end of the funnel: deciding quickly which alerts are real and acting on them.
What we watch

Every place an attack leaves a trace.

  • Laptops and servers

    Endpoint detection and response (EDR): malware, ransomware and hands-on-keyboard attackers.

  • Identity and sign-ins

    Microsoft Entra ID, Active Directory and Google Workspace: stolen passwords, MFA abuse, new admins.

  • Cloud

    AWS, Azure and Google Cloud activity logs: risky changes, exposed data, unusual access.

  • Email

    Phishing, malicious attachments and business email compromise.

  • Network

    Firewalls, VPN and DNS: connections to known-bad or unusual places.

  • Business apps

    Microsoft 365, Google Workspace and other SaaS: mass downloads, odd sharing, risky apps.

  • AI tools

    Use of public AI apps and the actions of your own AI agents.

  • Threat hunting

    Analysts search for quiet attackers that no alert has caught yet.

  • Threat intelligence

    New attacker techniques turned into new detections for your environment.

Your tools or ours: we work with what you already own, such as Microsoft Defender and Sentinel, CrowdStrike, SentinelOne, Splunk or Wazuh, or recommend and run a stack for you. We are vendor-neutral.

Know what you are buying

Alert forwarding is not detection and response.

Many “monitoring” services send you an email when a rule fires and leave the rest to you, often at 3 a.m.

Alert-only monitoring

You get the alerts. You do the work.

  • Collects your logs
  • Alerts forwarded with little context
  • No one acts until your team wakes up
  • No hunting for attackers that rules miss
  • Reports full of numbers, not answers

HanulSec managed SOC / MDR

We investigate and act, then explain.

  • Every alert checked by an analyst
  • Containment with pre-approved actions, any hour
  • Regular threat hunts
  • Named security lead who knows your business
  • Plain-language incident reports
How it works

Live in weeks, better every month.

  1. Weeks 1–2

    Onboarding

    Agree what matters most, who to call, and which containment actions we may take without asking.

  2. Weeks 2–4

    Log sources

    Connect endpoints, identity, cloud, email and network, with retention set for your legal duties.

  3. Weeks 3–6

    Detection tuning

    Tune rules to your normal, so real attacks stand out and noise drops.

  4. 24/7

    Live monitoring

    Triage, investigation, containment and threat hunting, every hour of every day.

  5. Every 3 months

    Quarterly review

    Trends, incidents, gaps and the next improvements, with your leaders.

What the rules expect

Logging and monitoring duties in India.

Several Indian rules assume someone is watching. We set up log collection and retention so you can meet them.

What you get

Answers, not alert counts.

HANULSECManaged SOC monthly report CLIENTSample · 400-person fintech SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical0High2Medium9Low31 COVERAGE · ENDPOINT · IDENTITY · CLOUD NO OPEN INCIDENTS Sample layout, not client data
  • 01
    Live dashboard

    Open alerts, incidents and actions taken, any time.

  • 02
    Incident reports in plain words

    What happened, what we did, and what you should do next.

  • 03
    Monthly executive report

    Trends, risks and improvements on two pages.

  • 04
    Named security lead

    One person who knows your systems and your business.

  • 05
    Agreed response times

    Written into the contract, fastest for critical alerts.

  • 06
    Quarterly threat hunt and review

    A deep look for quiet attackers, and a plan for the next quarter.

Who it is for

For teams that cannot watch all night.

  • Companies without a 24/7 security team, which is most of them
  • SEBI-regulated entities that need SOC monitoring under CSCRF
  • Firms that must report incidents to CERT-In within 6 hours, and so must notice them first
  • Teams that own security tools but have no one to watch the alerts
  • Companies whose cyber insurer asks for 24/7 monitoring or MDR

Under attack right now?

Call our 24/7 incident line on +91 0080887899 or email ir@hanulsec.com. See incident response.

Frameworks

Detections mapped to how attackers work.

MITRE ATT&CKAdversary behaviour
NIST CSF 2.0Govern to recover
CERT-InDirections and audit guidelines
DPDP Act 2023With the DPDP Rules 2025
SEBI CSCRFMarket entities
ISO/IEC 27001Information security

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01What is the difference between a SOC and MDR?
A SOC (security operations centre) is the team and tools that monitor an organisation’s security. MDR (managed detection and response) is a SOC delivered as a service that also responds: it investigates and contains threats instead of only sending alerts. Our managed SOC works the MDR way.
Q02Do we need our own SIEM or EDR?
No. We can use the tools you already have, or recommend and run a stack for you. Endpoint detection and response (EDR) on laptops and servers is the single most useful source, so we usually start there.
Q03What happens when you find a real attack at 3 a.m.?
An analyst confirms it, takes the containment steps you approved in advance, such as isolating a laptop or disabling an account, and calls your named contact. You get a written incident report afterwards.
Q04Does a managed SOC help with CERT-In’s 6-hour rule?
Yes. You cannot report what you have not noticed. We detect and triage incidents quickly, help you decide whether an incident is reportable and prepare the facts CERT-In asks for. The duty to report stays with your organisation.
Q05Where are our logs kept, and for how long?
Where your rules need them. The CERT-In Directions require logs of ICT systems to be kept for 180 days within India, and from 13 May 2027 the DPDP Rules require logs for personal-data processing to be kept for one year. We design storage and retention to match.
Q06Can you monitor our AI tools and agents too?
Yes. We can watch staff use of public AI apps and the actions your own AI agents take, and alert on risky behaviour. See shadow AI discovery.
Q07How is a managed SOC priced?
A monthly fee based on the number of endpoints, users and log sources, and whether you need response actions, threat hunting and a named lead.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings