Question 1

What is SOC Guru?

Accepted Answer

SOC Guru is a SaaS platform by AlpenShield that enables organisations to run their own SOC or MDR service based on Microsoft Sentinel. It covers the full incident lifecycle - detection, enrichment, AI-driven triage, 24/7 alerting, mitigation, SLA, ticketing and reporting - without building the underlying infrastructure. AlpenShield manages the detection rules, automation, AI models, and platform operations in the background.

Question 2

Who is SOC Guru for?

Accepted Answer

SOC Guru is designed for two primary audiences: MSSPs who want to build and operate their own branded MDR service, and enterprise organisations that want to run professional security operations in-house without hiring a full SOC team or an external MDR provider. The platform's multi-tenancy and white-label capabilities make it particularly suited for service providers managing multiple customer environments.

Question 3

How does SOC Guru differ from traditional MDR?

Accepted Answer

Traditional MDR providers operate your security on your behalf - you hand over control and receive alerts. SOC Guru takes a different approach: it enables you to run your own SOC operations with enterprise-grade tooling. You retain full visibility and control, your data stays in your own Microsoft Sentinel instance, and you can customise every aspect of the service - from escalation rules to automated mitigation thresholds. It combines the self-empowering aspects of a DIY SOC with the capabilities of a managed service.

Question 4

What Microsoft products does SOC Guru integrate with?

Accepted Answer

SOC Guru is built on Microsoft Sentinel and integrates with the full Microsoft Security stack. However, it supports all data sources which Sentinel supports, meaning basically all EDR, firewall and other vendors on the market.

Question 5

What are the technical prerequisites for SOC Guru?

Accepted Answer

You need an active Microsoft Azure subscription with a dedicated Resource Group for Microsoft Sentinel. For log sources beyond the Microsoft Security stack (e.g. firewalls, network devices), you are responsible for directing log data into Sentinel. AlpenShield provides Sentinel-side connector support for commonly used third-party vendors.

Question 6

How does multi-tenancy work in SOC Guru?

Accepted Answer

SOC Guru supports hierarchical account levels and multi-tenancy. Parent nodes have full visibility into their own data and all child nodes, while child nodes see only their own data. Each node operates its own Microsoft Sentinel instance. This makes it ideal for MSSPs managing multiple customers, or for large enterprises with complex organisational structures. Combined with RBAC roles, you have full control over who can see and do what at every level.

Question 7

How does the SOC Guru Agent work?

Accepted Answer

The SOC Guru Agent is an AI-powered autonomous analyst layer that operates around the clock. It handles high-volume, repetitive tasks automatically: enriching incidents, executing containment actions, querying end-users for context, and closing incidents based on configurable confidence-level thresholds. It also includes a cybersecurity LLM chatbot for analysts, supporting threat intelligence lookups, KQL assistance, and CVE queries. All automated actions are documented in the incident activity log.

Question 8

What does "up to 80% auto-resolution" mean?

Accepted Answer

Based on operational experience, the SOC Guru Agent can automatically resolve incidents through AI-driven triage and auto-closure. Each incident receives a confidence score - when the score exceeds the threshold you configure, the incident is closed automatically. You set the rules: which severity levels qualify, what confidence threshold applies, and what actions the agent can take. Everything is transparent - the AI explains its reasoning through structured assessments and per-component confidence ratings. For some customers this can be 60%, for others 90%. On average, AlpenShield has seen 80% to be a realistic estimate.

Question 9

Can automated mitigations be customised?

Accepted Answer

Yes. SOC Guru offers multiple mitigation layers, all of which are configurable per customer. AI-triggered mitigation handles high-confidence threats automatically. Rule-based mitigation uses predefined playbooks via Sentinel Automation Rules. You can also define your own automatic mitigation rules within the SOC Guru interface, leveraging asset classifications and threat intelligence data. One-click mitigation allows analysts to execute actions (host isolation, IP blocking, user disablement) directly from the Incident Workbench.

Question 10

How is SOC Guru priced?

Accepted Answer

SOC Guru uses a straightforward pricing model: a one-time setup fee plus a recurring monthly subscription. The monthly fee includes a base amount with a defined number of licensed users, plus a per-user fee for additional users above the included quantity. Exact pricing is agreed individually.

Question 11

Is white-labeling available?

Accepted Answer

Yes, SOC Guru is fully white-labelable.

Question 12

Is AlpenShield ISO 27001 certified?

Accepted Answer

Yes. AlpenShield GmbH is certified to ISO/IEC 27001:2022. The SOC Guru service is operated in compliance with GDPR. All data processing details are documented in the Data Processing Agreement. Certification and audit reports are available upon request. Your log data in your Sentinel instance remains in your own Azure tenant.

Question 13

How long does onboarding take?

Accepted Answer

The onboarding process is designed to be completed within approximately two weeks, subject to your team's availability and environment complexity. The process includes completing technical prerequisites on your side, AlpenShield verifying the environment and completing baselining, and then the service goes live.

Question 14

What happens during onboarding?

Accepted Answer

During onboarding, you set up the technical prerequisites (Azure subscription, Sentinel resource group, Entra ID app registrations, log data configuration). AlpenShield verifies your environment, completes baselining of your Sentinel instance, deploys detection rules, and configures the automation and AI analysis pipeline. Once everything is verified, the service goes live.

Question 15

Where is my data stored?

Accepted Answer

Log data ingested into Microsoft Sentinel resides exclusively in your Azure tenant — it is never transferred to AlpenShield. AlpenShield's platform components are hosted in Azure Europe by default, with alternative regions available upon request.

Frequently Asked Questions (FAQ)

All

About SOC Guru

Technical

AI & Automation

Commercial

Onboarding

See for yourself!