When we buy SOC services, is incident response included, or is it billed separately?

If your endpoint security tool supports remote actions, define them as automation playbooks in the contract. Before calling you in the dead of night, the analyst should be able to isolate the infected client with one click. That isn't active remediation, that's basic initial response and shouldn't cost extra.

During an attack we faced last year, the SOC provider called us in the middle of the night, said "there is unusual encryption activity on your server," and hung up. We had to bring in their response team, and they billed us for 18 hours at 4,000 TL an hour. Definitely get an included response bucket of at least 15-20 hours written into your contract.

Put together a RACI matrix immediately. Spell out line by line who gets notified on an alert, who isolates the host, and who verifies the backups. Hand it over and ask, "which of these action items will you own?" Then attach their response as an appendix to the contract.

Be skeptical of budget providers claiming "we handle and fix everything." If an intern analyst working the night shift for minimum wage shuts down your accounting server, the fallout will be worse than the breach itself. Active response without clearly drawn boundaries is extremely risky.

same thing happened to us they emailed at 4 am saying there was suspicious activity. when we walked in at 8 am the entire file server was already encrypted. tbh if all they do is send alerts theres zero point in paying that money.

Do you have an on-call sysadmin internally who can jump on systems kill a server or restore from backups when an alert drops at night? If not, you have to outsource the incident response.

Doesn't the EDR software automatically quarantine the threat on its own anyway? What's the practical difference between the SOC team doing that manually versus the software handling it?

Bottom line of this thread: Monitoring and alerting are baseline services, while deep IR gets billed extra. To keep costs predictable, write basic isolation actions into the standard package, and include a prepaid hourly response bucket upfront for deep analysis.

There's a trap here, let me mention it. When we decide without measuring we always end up in the same place.

When making decisions write down the worst-case scenario too, not just the best. That's all, sorry if I went on too long.

Let me share what happened to me; it might be useful. Forgotten test environments are more often the entry point than live systems.

If I were you, I'd go this route.

There is something to watch out for. Security isn't absolute; it's about making attacks not worth the effort.

Just leaving this note, it might be useful.

Quick summary for newcomers: If you get three different answers on a topic, the question was asked wrong.

Good luck with that.

My question might sound amateurish, sorry about that. When we decide without measuring, we always end up in the same place.

Most incidents start with a leaked password, not a vulnerability. Hope this helps.

My questions are cleared up, thanks. Everyone rushing into soc incident response included gets stuck at the same point.

Just leaving this note, it might be useful.

you're right, I've been down that road too and btw when making a decision first look at what data you have on hand.

taking notes for two weeks yields better results than a six-month estimate.

Let's separate the concepts, they're getting mixed up. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Proven by experience.

i completely agree but having backups accessible on the same network and with the same identtity makes them part of the target.

security isn't absolute; it's about making attacks not worth the effort... btw if you have questions write them; I'll answer as best I can.

I agree. If you scold false alarms, nobody will report again.

An untested backup is not a backup. That's all, sorry if I went on too long.