This reference explains what happens to a security event from the moment it is generated on one of your systems to the moment an analyst acts on it.
Data collection
Telemetry is pushed from your environment to intSignal — the SOC never needs
inbound access to your network. Connectors and log forwarders send events over
TLS to regional ingest endpoints (*.ingest.intsignal.com). Sources include:
- Identity providers (sign-ins, MFA, directory and privilege changes)
- Endpoint/EDR agents (process, file, and network activity)
- Firewalls, DNS, and proxies
- Cloud control-plane logs (CloudTrail, Azure Activity, GCP Audit)
- Business SaaS (email, file storage, collaboration)
Each source is health-checked continuously; a source that stops sending raises a data-health alert so gaps in coverage are caught quickly — the value of centralized security monitoring drops the moment a feed goes dark.
The detection pipeline
Raw events are normalized to a common schema, enriched (geo, asset, user, and threat-intelligence context), and evaluated against the detection rule set. That pipeline runs on intSignal SIEM, which brings multi-stage attack detection and correlation across identity, endpoint, network, cloud, and email to bear on each event rather than judging it against one source's rules alone.
- Rules are mapped to MITRE ATT&CK, so detections describe adversary behavior — for example credential access → brute force — rather than just raw log lines.
- Correlation links related events across sources into a single case (a suspicious sign-in plus a new inbox rule plus mass file access becomes one incident, not three alerts).
- Tuning suppresses known-good behavior in your environment to keep signal high.
Note
Detection content is maintained by intSignal's detection-engineering team and updated continuously as new techniques emerge — you do not author or maintain rules yourself, though you can request custom detections.
Analyst workflow
When a detection qualifies, it becomes a case and enters the analyst queue:
- Triage — an analyst validates the detection and sets severity.
- Investigation — the analyst pivots across correlated telemetry to establish scope: what happened, to whom, and whether it is still active.
- Decision — false positive (tuned out), informational (logged), or actionable (response initiated).
Every actionable case carries context, impact, and a recommended action so your team can decide quickly.
Response
Depending on the authorizations you set during onboarding, the SOC will either:
- Recommend and guide — you execute the remediation with our step-by-step guidance, or
- Act directly — where pre-authorized, the SOC contains the threat itself (isolate an endpoint, disable an account, block an indicator) and notifies you.
See Alert handling & escalation to configure what the SOC may do autonomously.
Where you see it
All cases, their status, and reporting live in the Network Portal, and are available programmatically through the Managed SOC API.