A workspace for providers and agencies
Create a SOCaaS program, invite participating agencies and present the agreement before they accept. Organization boundaries and scoped grants control access to program records.
SOC monitoring for IT and OT/ICS — Wazuh-powered detection, rule-based correlation into incidents, SOAR-lite playbooks, SLA tracking and forensics with chain-of-custody. Part of the RogueLogics security platform.
No credit card required · Free tier available · Open-source compatible
From raw log ingestion to automated remediation — SentinelOps handles the entire threat response lifecycle.
Ingest events from your Wazuh pipeline, EDR pulls (Defender, CrowdStrike, SentinelOne) and custom sources via API keys — with a live streaming alert feed.
Trigger-based playbooks automate your response — notify, escalate, create incidents and tickets the moment a matching alert lands.
Alerts are tagged with source-native ATT&CK data where available and deterministic detection rules across alert sources — from Initial Access to Exfiltration.
Correlation rules group related alerts and open incidents automatically — so analysts triage attacks, not individual events.
Full incident lifecycle with SLA tracking and breach alerts, Jira ticketing, forensics evidence with chain-of-custody, and PDF reports.
Ingest operational-technology telemetry alongside IT events — track OT assets and alert on industrial anomalies in the same SOC view.
The next wave of SentinelOps — identity threat detection, endpoint active response, IOC threat hunting, managed services, white-label reporting, a unified inbox, and an installable app. Not yet generally available.
Detects impossible-travel, MFA-fatigue, and brute-force across Microsoft 365, Google, Entra and Okta sign-ins — turning identity provider logs into actionable detections.
Ingests Microsoft Defender, CrowdStrike and SentinelOne alerts and runs approval-gated containment — isolate a host or trigger an AV scan, always with your sign-off.
ThreatWatch indicator-of-compromise feeds drive automatic retro-hunting across your history and generate new detections as fresh indicators arrive.
An analyst-staffed queue watches your alerts and incidents around the clock, with on-call paging and acknowledgement SLAs. Containment always needs your approval.
For managed-service partners: incident and forensics reports delivered to managed clients carry the partner's brand instead of ours.
A single pane across the whole platform that gathers your most important SOC activity — alerts, incidents, escalations, SLA breaches — into one prioritised stream.
Install SentinelOps to your desktop or phone home screen and opt in to push notifications so urgent activity reaches you even when the app is closed.
Plug into your existing open-source security stack in minutes.
Connect your Wazuh or OpenSearch instance, validate collection health, and review coverage and permissions before operation.
Get Started Free →Create a SOCaaS program, invite participating agencies and present the agreement before they accept. Organization boundaries and scoped grants control access to program records.
Review onboarding, adapter health, operations and audit records. Coverage acceptance requires supporting evidence; a configured connector alone is not proof of a working service.
Agencies can revoke participation. Review approved runtime AI findings separately from test assessment events, with tenant boundaries and duplicate protection.
SOCaaS requires explicit activation and configured, authorized adapters. No government endorsement, automatic statewide coverage or staffed 24/7 service is implied.
Explore guides and setupPublic-sector program preview
Follow incident events, response actions and detection coverage in a source-backed chronology.
Manage state security requirements, supplier and AI reviews, versioned reporting packages and public-records work in one connected program. Support state agencies, counties, cities and schools with explicit applicability decisions.
California SAM, SIMM and Cal-Secure, plus New York, Texas, Virginia and Washington reference packages.
Trace requirements and current evidence into SSP and other supported forms. Preview missing inputs, review the exact edition and preserve earlier exports.
Record vendor qualifications, AI providers and subprocessors. Follow changes into affected services and documents, then share reviewed snapshots with named public or private recipients.
Explore service dependencies, exposures and treatment work. Compare retained briefings and exact retest outcomes while keeping unrelated findings and review decisions separate.
Reference coverage and applicability are explicit. Generated documents need your review. Demonstrations do not establish live-provider qualification or agency approval.