SIEM and SOC Services
We collect and correlate logs from your servers, network, cloud and endpoints and monitor them around the clock, from triage to incident response.
A SIEM (Security Information and Event Management) platform collects logs from your servers, firewalls, cloud services, identity systems and endpoints, normalises them, correlates related events and raises alerts on suspicious patterns. A SOC (Security Operations Center) is the team and process that watches those alerts around the clock, separates real threats from noise and drives the response. The SIEM sees; the SOC understands and acts. Pedante Bilişim, Racoun’s technology arm, delivers both as a managed service under the Racurity brand.
What is included
- Onboarding log sources: Active Directory and Entra ID, servers, firewalls and VPN, Microsoft 365 and other cloud services, email gateways, EDR/XDR and critical applications.
- Normalisation and correlation rules mapped to MITRE ATT&CK, such as impossible travel or new admin accounts followed by log deletion.
- 24/7 monitoring and triage, incident response according to a pre-agreed response matrix, root cause analysis and recommendations.
- Continuous rule tuning, threat hunting and periodic reports for management and technical teams.
Our approach
We choose the platform to fit your environment, for example Microsoft Sentinel for Microsoft-centric organisations or local options where data must stay in Turkey. We focus on the right logs for the right questions, protect log integrity and restrict access because logs may contain personal data. Because our network, server, cloud and endpoint teams work under the same roof, we help fix the root cause behind alerts, and we use our penetration tests to check that attacks actually show up in your SIEM. Response permissions, such as disabling an account or isolating a device, are agreed in writing before the service goes live.
Frequently asked questions
What is the difference between SIEM and SOC?
The SIEM is the platform that collects and correlates logs and raises alerts; the SOC is the team and process that monitors, investigates and responds.
Do we have to use Microsoft Sentinel?
No. Sentinel suits Microsoft-centric environments, but other platforms are assessed through our solution partners based on your infrastructure and data residency needs.
Contact
Head office: Ataşehir, Istanbul. We work in person across Istanbul and online with clients all over Türkiye and abroad. Message us on WhatsApp (+90 551 044 08 69) or email ekip@racoun.com.
