We've been asked to send logs to a SOC — for our size, which team or role should handle this?

If you try dumping this on the sysadmins, both sides will be pointing fingers within the first month. The sysadmin will just ship the logs and move on, the SOC will say "these logs are incomplete," and your client will be stuck in the middle. You need at least one coordinator who understands security in between.

When pushing data from servers via syslog or agents, don't forget to account for bandwidth usage and CPU load. The sysadmin team can handle the setup, but timestamp consistency and encrypted transport require extra attention.

We went through a similar process with a 40-person team. We brought in an external security consultant for 20 hours a month, which cost around 18,000 TL monthly. We smoothed out the whole workflow with our sysadmin only spending about 4 hours a week on it.

Don't just start dumping logs blindly because the client asked for it. Most SOC firms charge extra for every useless log ingestion. If you don't strictly define the scope of what gets logged, you'll be hit with massive bills at the end of the month.

Exactly what logs is your client asking for? Just OS and firewall, or are database queries and in-app user activities included in the scope too?

Draft an escalation matrix right away. When the SOC calls in the middle of the night, who are they waking up? 1) Sysadmin, 2) Lead dev, or 3) The CEO? Don't even start the integration without getting this in writing.

they dumped it on our sysadmins too two months in the guys were ready to quit... anyway this definitely needs an outside consultant.

In short, infrastructure stays with sysadmins, code goes to devs, but alert tracking and contract coordination definitely need outside expert support.

Noted, thanks. An automated scan report is not the same as a penetration test.

I'll try it.

Saved. Everything goes well for the first three months; problems arise in the fourth.

When making decisions, write down the worst-case scenario too, not just the best. Correct me if I'm wrong.

correct.

Let me clarify the technical side. If you get three different answers on a topic, the question was asked wrong.

Let me summarize the topic, since several different answers were given. Hasty decisions become decisions you have to fix six months later.

I was thinking the same thing. Forgotten test environments are more often the entry point than live systems.

Absolutely. If I were to add anything: Taking measures without an inventory leaves doors you haven't seen open.

When making a decision, first look at what data you have on hand. Hope this helps.

Exactly like that. If it's your first time start small; scaling comes later.

If you post the result here it will help others too.

Exactly like that. Most incidents start with a leaked password, not a vulnerability.

Security isn't absolute; it's about making attacks not worth the effort. This is my opinion, I'm not claiming it's absolute truth.