Your tools, connected
Native connectors bring edge, identity, endpoint, network, cloud, and email security events into Vigilbase OS, with analysis already switched on.
Delivered on Vigilbase OS
Managed SOC as a Service on Vigilbase OS
Vigilbase runs your security operations on Vigilbase OS. We connect the security tools you already pay for and keep their events in one auditable record. The Vigil agent investigates, Vigilbase analysts handle exceptions, and response stays within the authority you set. Coverage and response times follow your Core, Priority or Critical SLA tier.
Runs on the tools you already pay for
Response within the authority you set
Coverage set by your SLA tier
What's included
What Vigilbase's managed SOC includes
One service, run on Vigilbase OS, from the first event to the verified result.
One auditable record
Logs and events from every connected tool stay auditable and queryable in one place, with dashboards for each team.
Investigation by the Vigil agent
The Vigil agent investigates high-severity incidents from the evidence in the record. Vigilbase analysts handle exceptions and decisions that need human review.
Response within your authority
Keep actions off, propose them for approval, or allow low-risk, reversible actions to run. Live actions run where supported, Cloudflare today; elsewhere the investigation returns the steps for your team.
Verification and reporting
Each investigation records the evidence, the actions taken, and the verification result. Reviews and reports follow your SLA tier.
Coverage by SLA tier
Core covers business hours. Priority and Critical add 24/7/365 coverage with defined response times.
How it works
How managed SOC works on Vigilbase OS
Four stages, each recorded, so you can see what happened and why.
Connect your tools
We connect the security tools you already pay for through native connectors, agree the permissions, and confirm what each provider supports.
Detect and investigate
Events arrive in a common schema with analysis switched on. The Vigil agent investigates high-severity incidents from the evidence, and Vigilbase analysts take the exceptions.
Respond within authority
Actions run only within the autonomy you choose: off, proposed for approval, or low-risk and reversible. Where Vigilbase OS cannot act directly, the investigation returns the steps for your team.
Verify and report
We check the result and record the investigation, the actions taken, and the verification. Reviews and reports follow your SLA tier.
Managed SOC coverage and response times
Coverage hours and response times come from the published Vigilbase SLA tiers. Choose the tier when you agree the scope.
| Service level | Core | Priority | Critical |
|---|---|---|---|
| Support Hours | Business hours | 24/7/365 | 24/7 + escalation |
| P0 Critical Response | Best effort | 30 minutes | 15 minutes |
| P1 High Response | Best effort | 1 hour | 30 minutes |
| P2 Medium Response | Best effort | 4 hours | 2 hours |
| P3 Low Response | Next business day | 1 business day | Same day |
| Incident Response | Advisory | Active mitigation | War-room |
| Reporting | Monthly summary | Weekly + dashboards | Custom + executive |
| Business Reviews | Quarterly | Monthly | Bi-weekly |
| Account Management | Shared team | Named TAM | Dedicated AM |
Core business hours are Monday to Friday, 9AM to 6PM. SLA timers start when Vigilbase acknowledges an incident and has sufficient access to begin mitigation.
Read the full SLA, priority definitions, and exclusionsManaged SOC vs MDR vs MSSP vs managed SIEM
The terms overlap. Here is how each one is usually used, and where Vigilbase fits.
Managed SOC
A security operations center monitors, investigates, and responds to threats. A managed SOC, or SOC as a service, is that function run for you by an outside team.
What is SOC?MDR
Managed detection and response is a service that detects, investigates, and responds to threats on your behalf, usually with analysts working from EDR and other telemetry.
What is MDR?MSSP
A managed security service provider is an outside company that monitors and manages security systems for you. Services range from managed firewalls to MDR and incident response.
What is MSSP?Managed SIEM
A managed SIEM is a SIEM that a provider runs for you: collecting logs, tuning correlation rules, and raising alerts. Investigation and response may or may not be included.
What is SIEM?Where Vigilbase fits
Vigilbase's managed SOC covers detection, investigation, and response within the authority you set, on Vigilbase OS. Like a SIEM, it keeps connected logs auditable and queryable in one place, but it runs on the tools you already pay for instead of replacing them. Live response actions run where Vigilbase OS supports them, Cloudflare today; for other tools, including endpoint tools, the investigation returns the steps for your team.
Which security tools does Vigilbase's managed SOC work with?
Native connectors cover edge, identity, endpoint, network, cloud, and email security, including Cloudflare, Akamai, Fastly, Imperva, Microsoft 365 and Entra ID, Google Workspace, Okta, CrowdStrike Falcon, SentinelOne, Microsoft Defender XDR, Palo Alto Networks, Fortinet, Zscaler, AWS, Google Cloud, Proofpoint, and Mimecast. Wiz is coming soon.
Log collection and analysis differ by provider, and a connection does not mean every response action is available. Where the platform cannot act directly, the investigation returns the steps for your team to complete.
Tools without a native connector can send Splunk HTTP Event Collector-compatible logs to a custom source. Those logs are stored alongside your other sources, but they are not analyzed automatically and carry no response actions.
Default retention is set per dataset, typically 30 to 90 days. If you need a long-term archive or compliance retention, decide where that data lives before you consolidate.
Run Cloudflare as well? Vigilbase also sells Cloudflare Enterprise licences and operates the account as Managed Cloudflare. Managed Cloudflare
What stays with your team
A managed SOC should not take decisions away from you. These stay yours.
Authority
You choose whether actions stay off, are proposed for approval, or run when they are low-risk and reversible.
Approvals
Changes that need sign-off wait for the approval contacts you name. The record shows who approved each change.
Policy
You set security policy and change authority. Vigilbase works within them.
Steps on providers without live actions
Where Vigilbase OS cannot act directly, such as firewall policy on Palo Alto Networks or FortiGate, the investigation returns the steps for your team to complete.
Your tools
The security products you already pay for stay in place and stay yours. Vigilbase connects to them with the permissions you grant.
How managed SOC is priced
Managed SOC is priced as a scope-based proposal. We do not publish a universal price or claim a savings percentage; compare written proposals for the same scope.
What the proposal is based on
- Connected systems
- Data volume
- Retention
- SLA tier
- Response authority
Cloudflare Enterprise licensing and Managed Cloudflare have their own agreed scope, with published Managed Cloudflare packages. Compare Managed Cloudflare packages
How to start with Vigilbase's managed SOC
Start with the tools you already pay for and the coverage you need.
Choose your tools
Tell us which security tools you already pay for and which systems the SOC should cover.
See it on your stack
On a discovery call, we map that stack onto Vigilbase OS and show a representative investigation, a permitted response, and its verification record.
Agree the scope
Confirm the connected systems, permissions, response authority, approval contacts, and SLA tier in a written proposal.
Connect and operate
We connect the agreed tools and run security operations within that scope, with reviews on your tier's schedule.
Frequently asked questions
Managed SOC questions, answered
Is Vigilbase an MSSP?
Yes. Vigilbase provides managed security services: a managed SOC delivered on Vigilbase OS, and Cloudflare Enterprise licensing with Managed Cloudflare. The work runs across the security tools you already pay for, with one auditable record of each investigation, action, and verification.Evaluate a managed security providerSecurity operations responsibilities
Is Vigilbase's managed SOC 24/7?
On the Priority and Critical SLA tiers, yes. Both provide 24/7/365 coverage, with P0 response in 30 minutes on Priority and 15 minutes on Critical. Core covers business hours, Monday to Friday 9AM to 6PM, with best-effort response times.Coverage and incident response commitments
Is managed SOC the same as MDR?
It covers the same core work: detection, investigation, and response within the authority you set, run by Vigilbase on the tools you already pay for. One boundary to know: live response actions run only where Vigilbase OS supports them, Cloudflare today. For endpoint and other tools, the investigation returns the steps for your team.Managed detection and response explained
Do I need to replace my SIEM or EDR?
No. Your EDR keeps running: Vigilbase connects natively to CrowdStrike Falcon, SentinelOne, and Microsoft Defender XDR. Vigilbase OS keeps connected logs and events auditable and queryable in one place, so it can take on day-to-day security operations across those sources. Keep your SIEM where you depend on its rules, long-term retention, or sources Vigilbase does not connect.Supported integrations and operating scopeWhat a SIEM does
What response actions can Vigilbase take?
It depends on the provider and the permissions you grant. Live response actions run in Cloudflare today, within the autonomy you set and with approval when required. For other connected tools, the investigation returns the steps for your team to complete, and the record shows what was done and how it was verified.How agentic cybersecurity worksSupported integrations and operating scope
How is managed SOC priced?
As a scope-based proposal. The price reflects the systems you connect, data volume, retention, your SLA tier, and the response authority you grant. We do not claim a universal savings percentage; compare written proposals for the same scope.Discuss your scope with VigilbaseCoverage and incident response commitments
Who owns the tools and the data?
You do. The security tools you already pay for stay yours, connected with the permissions you grant. Our Terms of Service state that you retain ownership of the data you submit through the services, and Vigilbase uses it only to provide them and to comply with the law. Default retention is set per dataset, typically 30 to 90 days.Privacy and data handlingSecurity documentation in the Trust Center
Hand your security operations to Vigilbase
Tell us which security tools you already pay for and the coverage you need. We will map them onto Vigilbase OS, show you a representative investigation, and propose a scope and SLA tier.