Managed Security
AI-Driven SOC 24/7
Detection, investigation and incident response operated around the clock by UPX. Supervised AI agents and analysts work the same case, from the first signal to containment.
20+ years
working in cybersecurity
24/7/365
in-house SOC, continuous operation
SOC 2 · ISO
SOC 2 Type 2 and ISO 27001
Companies that trust UPX
Overview
In operations built on queues and manual escalation, the alert waits for initial analysis, moves up a tier when needed, and only then does evidence gathering begin. Outside business hours or during demand peaks, answering whether it was an attack can take hours.
At UPX, the case covers that whole path without successive hand-offs. AI triages the alert, queries evidence across the tools and rebuilds what happened, while the team runs the investigation and decides the actions that require human judgement.
| Compared aspect | Traditional SOC | UPX AI-Driven SOC |
|---|---|---|
| Alert arrival | Waits for an available analyst | Triaged the moment it arrives |
| Querying the tools | One person queries one tool at a time | SIEM, EDR, identity and external context cross-referenced automatically |
| False positives | Surface at the end of the investigation | Attack, legitimate behaviour and misconfiguration separated at the source |
| Case flow | Alert, wait, tier 1 triage, escalation, investigation, wait, response | Alert, triage with investigation and context, analyst, response |
How it works
Every alert opens an investigation. The goal is to gather enough context to understand what happened and decide what needs to be done.
01 · Telemetry collection
SIEM, EDR, identity, network and other sources in the environment.
02 · Behavioural analysis
03 · Correlation
04 · Verdict and response
The SOC follows the same case through every stage, keeping evidence, context and history: detect, validate, investigate, correlate, decide, contain, document and evolve the defences.
Tiers 1, 2 and 3 in one flow
A SOC operation is organized into levels of analysis. At UPX, all three work in a continuous flow, with AI and analysts on the same case, from triage to response.
Triage · What needs investigating?
Validates the alert, removes duplicates, enriches context, reduces false positives and determines whether the case is recurring or warrants severity. Delivers: A prioritized alert, with context and rationale.
Investigation · What actually happened?
Queries raw events, cross-references sources, rebuilds the timeline, investigates persistence and lateral movement, and maps techniques to MITRE ATT&CK. Delivers: Technical investigation, evidence, conclusion and recommended actions.
Advanced analysis · How do we stop it recurring?
Deep hunting, expanding the search to other assets, root cause, assessment of systemic compromise, and proposals for new detections, containment and hardening plans. Delivers: Advanced assessment, root cause and improved defences.
Specialists are always in command. AI is integrated into the SOC tooling, and every action is logged and auditable, holding consistency even through demand peaks.
How responsibility is split between AI and specialists
AI agents work inside the SOC flow to query evidence, correlate signals and rebuild context. Specialists are accountable for the investigation, the interpretation and the decisions that require human judgement.
| AI agents | UPX specialists |
|---|---|
| Alert triage | Validation |
| Evidence querying | Technical investigation |
| Cross-source correlation | Impact analysis |
| Context reconstruction | Decision |
| Investigation support | Authorized containment |
| Evolving the defences |
The result of every case: verdict and response.
Indicators
Three time measurements follow every case, from the event to resolution.
| Indicator | Name | What it measures | Interval |
|---|---|---|---|
| MTTD | Mean Time to Detect | Time to detect | From the event to a qualified alert |
| MTTA | Mean Time to Acknowledge | Time to act | From the alert to the operation's first action |
| MTTR | Mean Time to Respond | Time to resolve | From the alert to closing the case |
Indicators are tracked per case and reported in the periodic reports. Targets are defined in the service agreement, according to scope and integrated sources.
What you receive
The operation does not end when the incident is closed. What the SOC produces serves both the people running security and the people deciding on risk.
What happened in the period
Cases opened, contained and closed by criticality, with the response time for each one.
Business impact
What was exposed, the residual risk and the decisions that belong to the board.
Posture and exposure
Vulnerabilities fixed and still open, telemetry coverage and blind spots that remain.
Technical reporting
For the security team: evidence, timeline, conclusion and next steps.
Executive reporting
For the board: impact, risk and business decision.
Weekly and monthly reports present indicators, trends and the security posture of the environment. Data is isolated per customer, with every action of the operation logged and verifiable.
Integrations
The SOC brings telemetry, context and evidence from different sources into a single operation. What determines the integration is the telemetry a tool makes available, not the vendor.
| Category | Technologies |
|---|---|
| SIEM | Google Security Operations, Splunk, Elastic |
| EDR / XDR | CrowdStrike Falcon, Microsoft Defender, SentinelOne |
| Identity | Microsoft Entra ID, Okta |
| Cloud | AWS, Google Cloud |
| Network | Cloudflare, Fortinet, Palo Alto Networks, Zscaler |
| Email and threat intelligence | According to the sources available in the environment |
Available from UPX.
Explore security platformsFAQ
Frequently asked questions
What sets the UPX AI-Driven SOC apart from a traditional SOC?
In a traditional SOC, the alert passes through queues and manual escalation between tiers. At UPX, AI agents triage the alert the moment it arrives and gather the evidence from the tools, and analysts run the same case from start to finish, with no successive hand-offs.How do AI agents take part in investigations?
They work inside the SOC flow: they triage alerts, query evidence, correlate sources and rebuild context to support the investigation run by the analysts. Their role is to gather and organize context, not to conclude the investigation.Are analysts still involved in the decisions?
Yes. Validation, technical investigation, impact analysis, the decision and containment are the responsibility of UPX specialists. AI extends the capacity to process volume and speeds up evidence gathering; judgement and accountability for the case stay human. Every action is logged and auditable.How do tiers 1, 2 and 3 work?
They are levels of analytical depth, not stages in a queue. Tier 1 triages and determines what needs investigating. Tier 2 rebuilds what happened and maps techniques to MITRE ATT&CK. Tier 3 deepens the analysis, identifies root cause and proposes improvements to the defences. At UPX all three work in the same flow, without losing the context of the case.Which sources and technologies can be integrated?
SIEM, EDR/XDR, identity, cloud, network, email and threat intelligence. What determines the integration is the telemetry a tool makes available, not the vendor. The integrations that apply to your environment are confirmed before the operation goes live.How does incident containment work?
Once the investigation confirms a threat, specialists define the actions and carry out the authorized containment — blocking, asset isolation, session revocation, escalation and playbook execution — with evidence and context logged in the case. The scope of what UPX executes directly, and what requires your team's approval, is agreed together at the start of the contract.Which indicators are used to measure the operation?
MTTD (time to detect), MTTA (time to act) and MTTR (time to resolve), tracked per case and reported in the periodic reports. Targets are defined in the contract, according to scope and integrated sources.How do the technical and executive reports work?
Technical reporting delivers evidence, timeline, conclusion and next steps for the people running security. Executive reporting translates the relevant incidents into impact, risk and business decisions. Weekly and monthly reports consolidate indicators, trends and the security posture of the environment, with data isolated per customer and every action logged and verifiable.
AI-Driven SOC 24/7
Talk to a specialist
Detection, investigation and response in the same operation, with the UPX AI-Driven SOC 24/7/365.