Are there good guides or references on what a monthly report from a Managed service provider such as a SOC would be ?
Add a comment
|
1 Answer
This is pretty loaded and will likely be dependent on your organization and business vertical. For instance, your organization may be interested in receiving monthly reports on failed logins for executives, but some orgs may not care about that (for various reasons...). In general though you will likely want to receive a number of reports, such as:
1) A report breaking down all critical or high risk incidents and their corresponding investigations for the month.
2) A report breaking down events be severity and category (as defined in conjunction with the SOC and the business). This can help with trend spotting.
3) A report discussing activity within the environment over the month such as it may affect the SOC and organization (such as EPS trends and so on).
Rackspace has something on this with sample reports here: https://www.rackspace.com/sites/default/files/white-papers/7_rackspace_managed_security_-_sample_reports_copy.pdf
