Onboarding
How SOC Onboarding Works
No multi-month enterprise project. We scope your estate, deploy agents and log sources, tune detections, then hand you a clear reporting rhythm, usually measured in days for a typical SMB.
SOCGuard onboarding has five stages: scope call, access and connectors, deploy and validate, tune and baseline, then go-live with your first report. Most 10–50 endpoint deployments complete within a few business days once IT access is ready.
1. Scope and edition fit
We confirm endpoint count, servers, cloud identity (for example Microsoft 365), firewalls, and which edition you need: Protection, MDR, MPR, or Managed SOC. You receive a short checklist of contacts, escalation channels, and admin access required. No THB multi-million setup fee.
2. Access and connectors
Your IT team approves agent install (or MDM push), server log collection where included, and optional cloud or firewall syslog sources for your edition. We schedule a short technical window so change control stays clean.
3. Deploy and validate
Agents and log sources come online. We verify heartbeats, coverage gaps, and that alerts can reach your designated contacts. You see assets appearing in the customer portal as they check in.
4. Tune and baseline
We reduce noise from known-good admin tools and business apps, set severity expectations, and confirm business-hours vs 24/7 escalation paths for your edition. MPR and Managed SOC add hunting and investigation playbooks at this stage.
5. Go-live and first report
Monitoring is marked live. You receive the reporting cadence for your plan (quarterly on Protection, monthly on MDR and above). From then on, critical alerts follow your published SLA path. Questions go to the same Bangkok SOC contacts you met at scoping.
What we need from you
Share endpoint count, OS mix, and any change-freeze windows. If you use MDM or RMM, we can often deploy without visiting each laptop.
Common questions
How long does onboarding take?
A typical 10–50 endpoint SMB goes live within a few business days after access is granted. Larger multi-cloud or multi-office estates take longer and are scoped on the contact call.
Do you need downtime?
Agent install is normally non-disruptive. Firewall or identity log connectors may need a short change window your IT team controls.
Can we start on Protection and upgrade later?
Yes. Many clients start on Protection or MDR, then move to MPR when they need vulnerability scanning, hunting, or multi-cloud coverage.
Ready to scope your environment?
Tell us endpoint count and cloud platforms, we recommend a tier within 24 hours.
