01
Connect the PSA and enroll tenants
PSA integration supports customer and asset enrollment. The provider manages each customer’s scope separately.
Service provider outcome: Separate tenant scope and asset inventory
← MSP solutions
Xcitium offering
SOC as a Platform (SOCaaP)
Delivering SOC services through an MSP. SOCaaP is a platform and service model that helps partners offer customers monitoring and security operations.
Discuss your requirements ↗
SOC as a Platform · MSP/MSSP operations
Operate customer environments through a shared SOC workflow
SOCaaP lets a service provider manage customers in separate tenants, collect endpoint, network, and cloud signals, investigate incidents, and route work into a PSA system.
02
Connect telemetry sources
Endpoints, network sensors, and cloud connections provide security signals; logs can be investigated in the shared workspace.
Service provider outcome: Signals associated with customer context
03
Investigate signals and choose an action
A SOC analyst or the provider’s team triages signals. Responsibility can differ between fully managed and co-managed models.
Service provider outcome: Investigated incident and agreed response owner
04
Route action and reporting
Incident records and response details can be attached to a PSA ticket, escalated to the customer, and retained for reporting.
Service provider outcome: PSA work item, escalation, and customer report
Separate customer tenants
Separate customer tenants 1
EndpointNetwork sensorCloud logs
Separate customer tenants 2
EndpointNetwork sensorCloud logs
Separate customer tenants 3
EndpointNetwork sensorCloud logs
Shared SOC workspace
Analyst triage
SOC responseCo-managed response
PSA ticketCustomer escalation
Service provider outcome
Each customer’s signals retain tenant context, are investigated in a shared SOC workspace, and follow the agreed response route.
Capabilities
Capabilities with a specific purpose
Scope
SOCaaP is a platform model that helps an MSP/MSSP build security operations and SOC services for its customers.
Workflow
The partner configures customer tenants, telemetry sources, alert operations and its customer-facing response workflow.
Output and handoff
The partner defines the customer-facing SOC service and its operating and delivery process.
Responsibility boundary
Before onboarding customers, choose fully or co-managed operation and agree analyst coverage, response responsibilities and escalation.
Compare approaches
Service role and adjacent approach
| Consideration | SOC as a Platform (SOCaaP) | Managed SIEM |
|---|---|---|
| Primary focus | SOCaaP is a platform model that helps an MSP/MSSP build security operations and SOC services for its customers. | Managed log monitoring and analytics delivered to a customer. |
| Workflow | The partner configures customer tenants, telemetry sources, alert operations and its customer-facing response workflow. | Log onboarding, correlation rules, SOC alert validation and ticketing. |
| Output and handoff | The partner defines the customer-facing SOC service and its operating and delivery process. | Validated alerts and customer reports. |
Before you start
Design the partner service model
Define tenant separation, admin roles, customer-facing branding/portal, onboarding, SIEM sources and incident-escalation ownership. Use two test customer contexts to check tenant roles, event routing and PSA handoff; confirm which team acts in the selected fully or co-managed model.
- 01
How are tenant and data boundaries separated per customer?
- 02
Who owns response across partner SOC, customer IT and Xcitium?
- 03
What is included in branding, portal, billing and licensing?
Evidence for your evaluation
In practice
An MSP builds a SOC service
A managed service provider wants to offer security monitoring to customers without building a SOC operation from scratch. SOCaaP is a platform and service model for partners to deliver security operations to their own customer base.
What your team gains
- 01
SOC service delivery model for MSP clients
- 02
Defined onboarding and source plan
- 03
Clarified partner and customer responsibilities
Before you decide
Questions, answered
Who is SOCaaP for?
SOCaaP is for MSP/MSSP partners building a SOC service.
What operating model does the platform help an MSP build?
The platform helps the partner onboard customer environments, configure telemetry and alert handling, and operate its own response service.
What commitments does the partner make to its customer?
The partner defines its customer-facing SLA, analyst coverage and incident-response responsibilities in its offer.
Next step
Discuss your requirements
Tell us about your environment and priorities to discuss the right solution, pilot scope and rollout in Azerbaijan.