Security Operations · Flagship service

Managed SOC.

Your security. Your infrastructure. Our expertise.

Take the 5-Minute Cyber Maturity Assessment

15 min
P1 response SLA
2 hrs
P1 containment SLA
24/7
Certified analyst coverage

Certified & audited operations

Verify at our trust centre

The landscape

What companies are facing right now

Smarter cyber threats

Attackers now use AI-driven tactics, zero-day exploits, and social engineering to breach defenses faster than ever.

Expanding attack surface

Cloud systems, remote work, and connected devices have exploded the number of entry points.

Overloaded teams

IT and security teams struggle with alert fatigue, tool sprawl, and limited 24/7 visibility.

Compliance pressure

Meeting ISO 27001, GDPR, and PCI DSS requirements has become a constant challenge.

Longer dwell time

Threats often remain undetected for weeks — turning minor incidents into costly breaches.

Delivery models

One SOC. Three ways to run it.

The workflow, the platform, and the discipline are the same in every model — the only difference is who operates it. Most clients start with SOC as a Service; the deeper your own team, the more you can share the load.

Fully managed

Most chosen

SOC as a Service

We run it all, from our SOC.

A fully outsourced, cloud-delivered SOC on subscription — our watch floor, our full stack (SIEM, SOAR, EDR, threat intel, AI automation), our certified analysts. No infrastructure to buy, no team to hire.

Who runs it

Zentara runs everything, end to end.

Best for

Mid-scale organizations facing enterprise-grade threats without enterprise budgets or teams.

Talk to an expert

Shared / hybrid

Co-Managed SOC

We share the watch with your team.

A shared model that fits how your team already works — you cover business hours or L1/L2, we cover nights, weekends, and L3 depth. Any split works, with detection engineering and joint incident command layered on top.

Who runs it

You and Zentara operate together, by an agreed split.

Best for

Organizations and MSSPs with a capable day-shift team but gaps in after-hours or specialist depth.

Talk to an expert

Your SOC, our analysts

SOC Staff Augmentation

Our certified analysts, embedded in your SOC.

We place vetted, certified analysts (CEH, CIHE, Security+) into your security operation under your command structure — with Zentara L3 escalation behind them. Transparent manday rates, aligned to INKINDO standards.

Who runs it

You run the SOC and keep control; we supply the people.

Best for

Organizations that run their own SOC but can't hire the certified bench fast enough.

Talk to an expert

Need a SOC built and handed to you outright? That’s a different engagement — Turnkey SOC (Build-Operate-Transfer).

Packages

Coverage sized to your risk

Every package is the same 24/7 operation: L1, L2 and L3 analysts on Zentara's own platform. What changes is depth — what we watch, how often we hunt, and how much we handle for you.

COREThe 24/7 foundation

For organisations that need round-the-clock eyes on their critical systems, with full L1–L3 response behind every alert.

Includes

24/7 monitoring with full L1, L2 and L3 support
SIEM detection on alert and attack logs
5 custom detection use cases a year
Monthly report, presented to your team
An annual threat hunt and ZEN INTEL scan

Discuss CORE

Recommended

EDGEDetection in depth

For organisations under audit or regulator scrutiny that need network and host detection, regular hunting and tested defences.

Everything in CORE, plus

Network and host intrusion detection (NIDS and HIDS)
Vulnerability assessment twice a year
Threat hunting and ZEN INTEL scans twice a year
10 custom use cases a year and a custom request every month
Multi-channel alerts and an annual awareness session

Discuss EDGE

APEXThe full operation

For high-stakes institutions that need every log analysed, monthly hunting and incident response on hand.

Everything in EDGE, plus

Full sensor suite: honeypot, network forensics, threat intelligence
Every log analysed, with a further month kept offline
Monthly threat hunting and continuous ZEN INTEL monitoring
Incident response assistance, three times a year
Quarterly vulnerability assessment and unlimited use cases

Discuss APEX

Built by Zentara

Our own platform, in every package

The tools behind the packages are ours. We build them, run them and answer for them.

SIEM
ZX
Collects, correlates and enriches your logs in real time. The detection layer of every package.
See the product
Threat intelligence
ZEN INTEL
Checks your domain for leaked credentials, breach data and dark-web exposure. Continuous monitoring on APEX.
See the product
Security appliance
ZENTARA appliance
Runs the package's sensors inside your environment. In the cloud, on an instance you provide.

Compare

Every inclusion, side by side

Download the full service deck

Every inclusion, side by side
What's included	CORE	RecommendedEDGE	APEX
Monitoring & detection
Monitoring & detection
Security monitoring 24/7	CORE: Included	EDGE: Included	APEX: Included
SOC supportEvery alert can move from triage to investigation to response.	CORE: Full: L1, L2, L3	EDGE: Full: L1, L2, L3	APEX: Full: L1, L2, L3
Log management & SIEMZXRuns on ZX, Zentara's own SIEM.	CORE: Included	EDGE: Included	APEX: Included
Detection technologiesSensors run on the ZENTARA security appliance in your environment.	CORE: SIEM only	EDGE: SIEM + NIDS & HIDS	APEX: Full: SIEM, NIDS, HIDS, honeypot, network forensic tools, threat intelligence
Logs integrated & analysedAll logs adds operational logs, such as performance and process events.	CORE: Alert & attack logs	EDGE: Alert & attack logs	APEX: All logs
Log retentionOnline logs are ready to analyse in real time. Offline logs are archived and extracted before analysis.	CORE: 1 month online	EDGE: 1 month online	APEX: 1 month online + 1 month offline
Platform & assets
Platform & assets
Security applianceThe ZENTARA appliance, on premise. In the cloud, an instance or VM you provide.	CORE: Included	EDGE: Included	APEX: Included
Asset integrationOnboarding the assets defined in scope.	CORE: Once	EDGE: Twice a year	APEX: Continuous
Asset changesAdding new assets to monitoring during the contract.	CORE: Not included	EDGE: Not included	APEX: Unlimited
Custom use casesNew SIEM detection rules, built for your environment.	CORE: 5 a year	EDGE: 10 a year	APEX: Unlimited
Case management mobile appFor 5 users.	CORE: Included	EDGE: Included	APEX: Included
Hunting, response & intelligence
Hunting, response & intelligence
Threat hunting	CORE: Once a year	EDGE: Twice a year	APEX: Monthly
Incident responseHands-on assistance when a valid incident occurs.	CORE: Not included	EDGE: Not included	APEX: 3 times a year
ZEN INTEL threat intelligenceZentara-builtExtended threat intelligence for one domain.	CORE: 1 scan a year	EDGE: 2 scans a year	APEX: Continuous monitoring
Vulnerability assessmentScanning of the covered scope, with a report.	CORE: Not included	EDGE: Twice a year	APEX: Quarterly
Case notificationHow we reach you when we confirm a valid attack: email, WhatsApp, Telegram or your ticketing system.	CORE: Email	EDGE: Multi-channel	APEX: Multi-channel
Reporting & advisory
Reporting & advisory
SOC reportingEvery report is presented to your team. Monthly reports arrive by day 3 of each month.	CORE: Monthly	EDGE: Monthly + annual	APEX: Monthly, half-year + annual
Custom requestsAd-hoc reports, or a search for a specific alert.	CORE: 3 a year	EDGE: 1 a month	APEX: 10 a month
Subject-matter expert supportTime with our specialists on security questions in your environment.	CORE: 1 ticket a year	EDGE: 3 tickets a year	APEX: Unlimited
Security advisoryAdvisories when a relevant threat emerges.	CORE: As issued	EDGE: As issued	APEX: As issued + playbook
Security awareness session	CORE: Not included	EDGE: Once a year	APEX: Twice a year
Compliance support	CORE: As needed	EDGE: As needed	APEX: As needed
Maturity scorecardA security maturity assessment, repeated to show progress.	CORE: At the start	EDGE: Start and end	APEX: Start, half-year and end
	Discuss CORE	Discuss EDGE	Discuss APEX

Discuss EDGE

Packages are scoped to the assets you define. Scope and price are confirmed in writing after a scoping call.

Service levels

A clock on every severity

Every alert is classified on arrival. Each severity has its own response and containment target.

P1 · Critical
Active attack causing service outage or data loss
Response
15 minutes
Containment
2 hours
We tell you by: Phone + email
P2 · High
Major incident: no data loss yet, but high risk
Response
30 minutes
Containment
4 hours
We tell you by: Email + portal
P3 · Medium
Suspicious activity that needs investigation
Response
1 hour
Containment
8 hours
We tell you by: Portal
P4 · Low
Informational or benign alerts
Response
4 hours
Containment
24 hours
We tell you by: Monthly report

The problem

Building an internal SOC takes 18 months and Tier 2/3 analysts the market does not have. Meanwhile alerts pile up, dwell times grow, and regulators expect answers.

Track record

Operating dedicated and managed SOCs for national banks, telecom operators, and regional lenders.

Our approach

24/7/365 monitoring, detection, and response run by certified analysts (GCIA, GCIH, OSCP, CEH).
Built on the ZX platform — full SIEM capability without the buildout, with behavioral analytics and AI-assisted triage.
Infrastructure stays client-hosted where data sovereignty demands it — built for hybrid environments.
Threat hunting included, not just alert monitoring.
Monthly reporting on executive and technical tracks.

Methodology

The incident response workflow

Five stages, run the same way at 3 PM and 3 AM — from readiness to verified recovery.

Preparation

Build readiness and resilience before an incident occurs — asset onboarding, log integration, playbook alignment.

Detection & Analysis

Identify and confirm security incidents quickly and accurately — continuous correlation, behavioral analytics, L1–L3 triage.

Containment

Prevent threats from escalating or spreading within the environment, with pre-approved actions inside SLA.

Eradication

Eliminate the threat and ensure it cannot reoccur — root-cause closure, not reimaging and hoping.

Recovery

Return to full business operations with confidence, with verified restoration and lessons folded back into detection.

Inside the operation

People, process, and technology — one operational picture

Certified L1–L3 analysts on the ZX platform, correlating telemetry across cloud and on-premise estates from Greater Jakarta. Your cybersecurity shouldn't sleep. That's why we don't either.

Want this floor in your building? See Turnkey SOC

Hand off the watch

The fastest path to 24/7 coverage is our SOC, not your next hire

SOC as a Service puts our watch floor, platform, and certified analysts on your alerts from day one — no build, no bench to recruit. See it run against your environment.

Request a demo Take the 5-Minute Cyber Maturity Assessment

Standards & frameworks

Every engagement is mapped to the regulations you answer to — so the evidence your auditors and regulators expect is a by-product of the operation, not a scramble.

ISO 27001:2022SOC 2 Type IIPCI DSSNIST CSFOJK / BI regulationMAS TRM

What you receive

24/7 security monitoring & threat hunting
Real-time alerting & incident triage
Tiered SLA response — P1 acknowledged in 15 minutes, contained in 2 hours
Analyst reports & threat summaries

Go deeper

Technical documentation

For the engineers and architects in the room — the full methodology, in writing.

The deck our team walks new clients through: how the SOC is delivered, how it connects to your on-premise and cloud estate, the response targets by severity, and the three packages compared line by line.

The delivery models, and who runs what in each
Architecture and workflow, on premise and in the cloud
The incident response workflow, from preparation to recovery
Service levels by severity, from P1 to P4
ZX, Zentara's own SIEM, inside the operation
CORE, EDGE and APEX, compared line by line

A technical reference for security architects, SOC leads, and infrastructure engineers evaluating managed security operations. It details the detection engineering principles, platform architecture, deployment topology, and operational workflows underpinning Zentara's AI-Powered SOC.

SOC architecture: design principles, tradeoffs, and the core technology stack
Detection methodology — AI behavioral analytics vs. rule-based approaches
Deployment models compared: on-premise, cloud, and hybrid topologies
The incident response pipeline, step by step
Integration architecture for on-premise and cloud estates
SLA engineering, performance metrics, and competitive positioning

Zentara's playbook for building or upgrading an AI-augmented SOC that is operationally capable and regulation-aligned in the ASEAN and Indonesian context.

Where SOC operations are going in 2026 — ASEAN and Indonesia specifically
What AI actually does (and doesn't do) for SOC operations
A roadmap and maturity model to benchmark your SOC against
The checklist: is your SOC AI-ready and regulation-compliant (OJK, BSSN, ISO)?
A people-process-technology workflow you can tailor
The indicators and metrics that define SOC success

FAQ

Common questions

Straight answers. If yours isn't here, ask us directly.

They're three ways to run the same operation. SOC as a Service is fully managed on our stack — the fastest path to 24/7 coverage with no build or bench to hire. Co-Managed shares the watch with your team (you cover day or L1/L2, we cover nights or L3). Staff Augmentation embeds our certified analysts into your own SOC while you keep control. Same workflow, same SLAs — the only difference is who operates it.

Yes. Operations are vendor-agnostic — we run engagements on Elastic, Splunk, Sentinel, SentinelOne, Trellix, and the ZX platform, integrating with the tools you already own.

P1 incidents are acknowledged within 15 minutes and contained within 2 hours under the tiered SLA — with pre-approved containment actions executed inside SLA, not waiting on a call chain.

No. Infrastructure stays client-hosted where data sovereignty demands it — the operation is built for hybrid environments, with monitoring and response delivered over your estate.

Included, not optional. The engagement covers proactive threat hunting alongside 24/7 monitoring, detection, and response — because waiting for alerts means waiting out dwell time.

Monthly reporting on two tracks — executive and technical — plus real-time alerting, incident triage records, analyst reports, and threat summaries throughout the engagement.

Build the program

Pairs well with

vCISO — Virtual CISO

A SOC watches the estate; a vCISO owns the program around it. Add a named security executive to run governance, own regulator correspondence, and turn SOC output into board-level decisions.

Explore