How Seculogik helps a small SOC do the work of a large one
Most fully staffed SOCs are two to ten people, and most run 24/7 anyway. Where the hours actually go — tier 1 triage, escalation, the shift handover, the backlog — and what Seculogik gives back.
Integration scope: Seculogik uses a source-agnostic architecture to ingest security alerts and events through its own data map. Wazuh and OpenSearch are the first integrations. Other named sources describe planned connector targets; their availability must be confirmed for each evaluation.
The SANS SOC Survey 2025 puts the most common fully staffed SOC at between two and ten people, and reports that 79% of SOCs run around the clock. Do the arithmetic: at the low end there is no 24/7 rota, there is one person on-call. That team is not understaffed by accident; it is understaffed by definition — and so is the MSSP bench watching several customers from one screen.
Every tool such a team buys should be judged by two measures: the hours it gives back, and whether the bill grows every time you log more.
Seculogik is built for both. It is not another SIEM and not another sensor. It sits above the detection stack you already run — open-source SIEM and data stacks such as ClickHouse, Elastic / ELK, OpenSearch and Wazuh; market platforms such as Splunk, Microsoft Sentinel, CrowdStrike, Microsoft Defender, SentinelOne, Cortex XDR, Fortinet, Okta and Entra ID; cloud telemetry from AWS and Azure. If a source is not on the list, we build the connector, or you push events through the generic webhook and map them once.
And it is licensed per deployment, per year — no per-gigabyte, per-endpoint or per-customer meter, so sending it more of your telemetry never costs more. Metered ingest puts your bill and your detection coverage on opposite sides: the cheapest way to hold the bill down is to send less, and sending less is how coverage quietly falls. Two things move the price: the edition you deploy, and the modules you switch on.
Whatever feeds it, the job is the same: alerts → cases → decisions. In a team this size the same person is tier 1 and tier 2, and carries the out-of-hours phone as well. This post is about where those hours go, and what Seculogik does about each.
Hour sink one: manual correlation
Microsoft and Omdia's vendor-commissioned State of the SOC study (2026) found that two thirds of SOCs lose about a fifth of their weekly capacity to manual correlation. That is a full day per analyst per week spent joining alerts by hand: the same host name in three consoles, and someone deciding from memory whether they belong together.
The strongest signal in most estates is agreement. When your EDR, your identity provider and your SIEM each hold one piece of the same story, that is a case — and none of those tools can see it alone, because none of them sees the other two. Seculogik is where they meet.
Its Correlation Engine does that joining before a human looks, and it turns on with the Client edition. Nine independent checks look at every alert — how an entity is behaving, how far the attack has progressed, whether a known-benign pattern explains the whole thing — and they have to agree on a single verdict.
The analyst opens a case that already knows which alerts belong to it, and why. That "why" stays with the case as a readable decision trace, so the reasoning survives the shift handover, and the auditor's question six months later.
Hour sink two: noise that looks like signal
Every SOC knows the moment: one rule fires hundreds of times in a few minutes. That is not hundreds of incidents, and it is not one line in a list either. Deduplication would give you the one line and throw the volume away — and the volume is the reason it matters.
It is one incident that deserves to be rated higher than any of its parts. Seculogik absorbs the burst and files it as a single, appropriately rated case — hundreds of low-severity failed logons become one high-severity brute-force case — and nothing in the burst is lost.
Noise suppression is a different job, and the catalogue of known-benign patterns does it: the scheduled-backup class of event, the false positive a small team re-decides every week. The trace names the pattern it matched, so suppressed never silently becomes gone.
Alert fatigue is rarely the raw count. It is re-deciding the same thing every morning: the burst you rated yesterday, the backup job you cleared last week.
Hour sink three: deciding what to open first
A queue without ranking is a list, and a list gets worked top to bottom by whoever is on shift — what nobody reaches becomes the backlog. Seculogik opens on a decision queue instead: awaiting triage, SLA at risk, high risk, unassigned critical — computed the same way every time, so two analysts looking at the same board see the same priorities.
Cases are auto-assigned by current workload, so the queue balances itself across the team on shift; SLA clocks run per severity; and the kill-chain position of a case advances with its evidence, so the case that reached lateral movement rises above the one still at initial access.
That is the picture for one organisation: your estate, your analysts, one queue. If you run a managed SOC, the MSSP edition adds hard separation between the customers you serve, each in its own case space, and holds back an alert it cannot attribute with confidence rather than filing it under the wrong one.
Hour sink four: the write-up
An analyst who has decided still has to explain — to the shift lead, to the executive who signs off, to the regulator. Those are three different questions: what happened, what the business impact was, and whether the posture holds.
Seculogik keeps the decision trace with the case: which signals mattered, how the verdict was reached, and what would have changed it. The case report tells that story with its kill-chain position, and the SOC Reporting module turns the same evidence into case and organisation reports, scorecards for NIST CSF, ISO 27001, GDPR, DORA and NIS2, and evidence packs that state their own methodology and coverage.
Every number carries the evidence behind it, and a metric that cannot honestly be computed — an MTTR with too few closed cases behind it — says so rather than guessing. The write-up becomes a by-product of working the case, not a second job at the end of the shift.
Hour sink five: the second opinion, when there is no tier 2 to ask
A two-person SOC has nobody to escalate to. SIROC — our AI analyst, the Advanced AI module — is the tier 2 in the room: it reads the case, argues it in the open — benign hypotheses first, evidence both ways, verdict last — and has its cited evidence checked against the case's own alerts.
A verdict the evidence does not support is downgraded in front of the analyst, not quietly accepted. What comes back is a verdict, a confidence score, and the reasoning that produced both — not an answer the analyst has to take on trust.
By default it runs on a local open-licence model on your own CPU, so the second opinion costs electricity rather than an API bill or a data transfer. If you choose to bring your own cloud key for some tasks, secrets and personal data are redacted before anything leaves the box, and every cloud-bound call is written to a tamper-proof ledger.
When an analyst agrees or corrects it, the correction is kept with the case, so the second opinion improves on your own cases rather than on somebody else's.
Hour sink six: the response nobody wants to script at 03:00
Response playbooks (the Automations module) run the routine first moves on a case, so nobody repeats the same steps at three in the morning. Before anything destructive, such as isolating a host or blocking an address, the playbook stops at an approval gate and waits for a named approver — it does not time out and quietly carry on.
The routine moves run on their own; anything irreversible stays human-in-the-loop.
When the answer is yes, remote response agents running on your own hosts carry out the remediation against the tools you already own — your EDR, your firewall, your identity provider: CrowdStrike, Microsoft Defender, SentinelOne, Fortinet, Okta or Entra ID among them, and a connector we build if yours is not on the list — with vendor credentials that never leave those hosts. The platform never holds them.
The measure
A small team on Seculogik spends its hours on decisions, and every decision it makes is ranked, evidenced and still readable at the next shift handover.
That is the claim, and it is the whole of it: we do not claim to replace the analyst, and we do not sell an autonomous SOC. We publish no accuracy figure of our own — no credible cross-vendor benchmark for AI triage exists yet, and we would rather help build a reproducible one than quote a number nobody can check. We are early by design, and we say so: there are no customers to name yet, and the first design partners will shape the roadmap and get direct engineering access.
Which edition you deploy and which modules you switch on are the only two questions left, and the price follows from those two answers. See what each edition includes — Free and Client for one organisation, MSSP for many.