Detection and response, run by SovSec analysts.
Prismara SOC is the platform SovSec's analysts use to detect, investigate and respond to threats. It ingests Microsoft security sources, pseudonymises telemetry on arrival and correlates it into incidents. Your team follows the same incidents in a read-only client view and receives reports written from your own data.
What Prismara SOC does
Continuous ingest
Connectors sync each tenant's sources on checkpointed cycles and resume without loss after a restart.
Correlation rules
Rules for password spray, impossible travel, business email compromise chains, privileged MFA changes and mass downloads, kept as data so they can be tuned per client.
Live incident queue
Alerts and incidents update in the console as they happen, with bulk assign, resolve and dismiss.
Reports from your data
Monthly posture reports, incident post-mortems and sovereignty posture reports, filled in from your tenant's own telemetry.
Roles
SovSec Analyst, SovSec Admin, Partner Admin and Client Viewer, each scoped to the right tenants.
Filters and history
Filter alerts and incidents by tenant, severity, status, assignee or ATT&CK technique. Every alert and incident keeps its own audit history.
How it's secured
Prismara SOC follows the engineering rules shared across the suite, plus these product-specific measures.
Pseudonymised on arrival
Personal identifiers are replaced with HMAC-SHA256 pseudonyms as data arrives, with the real values in a per-tenant identity vault.
Analysts can't unmask
Restoring real identities is limited to the client's own roles, by design.
Tamper-evident audit
Every analyst action is written to a SHA-256 hash-chained audit log.
Demo and live separation
Demonstration data is isolated from live client data.
Connects to the rest of the suite
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.