Will a NOC notice a break-in?

Sometimes a NOC sees a symptom, such as a server that suddenly sends far more traffic out than usual. But a NOC looks at interfaces, routes and traffic flows, not at what happens on your servers and in your accounts. Intrusion detection needs different data and different work; that is the domain of a SOC or an MDR service.

What is the difference between a SOC and MDR?

A SOC is the team and the workplace that assess and investigate security alerts. MDR (managed detection and response) is a service in which an outside party does that for you, usually with its own software on your endpoints and the right to intervene, such as isolating a machine. For most smaller organisations, MDR is the realistic form of a SOC.

Can you send our logs to our MDR provider?

With NOC-as-a-Service we can forward our alerts to your systems, and your own equipment can send its logs straight to your MDR provider. We agree on those flows during the intake; your own dashboards and tooling stay yours.

NOC vs SOC: what to expect from your network partner during an incident

"Our network partner monitors everything, so security is taken care of." You hear that reasoning a lot, and it confuses two different services. A NOC (network operations centre) watches whether your network works. A SOC (security operations centre) looks for attackers who are already inside. Both look at your infrastructure, but they ask a different question, use different data and call different people when an alarm goes off. Buying a NOC service does not give you a SOC. Below: what you can expect from your network partner during an incident, and what you need to arrange elsewhere.

Two questions, two kinds of data

A NOC asks: does it work? Are the interfaces up, are the BGP sessions established, is a link saturated, is the equipment responding? The data are SNMP counters, session state, traffic flows and syslog from routers and switches. The alarm goes off when something goes from healthy to unhealthy, and the answer is repair: a failover, a replaced optic, a ticket with the carrier.

A SOC asks: is someone here who should not be? The data are login attempts, process activity on servers and workstations, changes to accounts and permissions, and alerts from security software, correlated across systems. A successful break-in with stolen credentials often shows nothing on a NOC dashboard. Every light is green, because the network is doing exactly what it should.

It is the same distinction as between monitoring and error tracking: you need both, and one does not replace the other.

Where they meet

There is a strip where the network does see an attack:

DDoS — an attack on availability, so network territory. Detection and mitigation happen at the network edge, and you can follow an attack in the dashboard.
Unusual traffic — a server that suddenly sends a lot out at night, or opens connections to countries where you have no customers. A NOC can spot and report that. Whether it is a data leak or a misconfigured backup job is for someone with access to that server to find out.
Vulnerable equipment — a firewall or router with a known vulnerability is a network matter. Patching is part of management, even when the trigger is a security advisory.

What to expect from your network partner

During an incident that affects your service, your network partner should deliver:

A notification within an agreed window — under NIS2 you have to send an early warning within 24 hours. We report an incident that affects your service within 8 to 12 hours, so you can meet that deadline. More about that agreement in NIS2 supplier requirements.
A timeline — what was seen, when, and what was done. With timestamps from synced clocks, otherwise they cannot be lined up against your MDR provider's logs.
Configuration history — what changed on the equipment, by whom and when. If the configuration is in version control, that is one command.
Intervention at network level — shutting a port, blackholing a prefix, placing a filter. Following agreed playbooks or after your approval, not on its own initiative.
Forwarding logs and alerts — to your own systems or those of your MDR provider, in a format they can read.

What you should not expect: forensic investigation on your servers, analysing suspicious processes, searching your accounts for traces of an attacker. That takes access, tooling and people who do it every day. We do not have a SOC, and we would rather say so up front than during an incident.

Arrange the handover in advance

The weak point is usually not the NOC or the SOC but the handover between them. If it is only worked out at the first incident, the first hours go into looking up phone numbers. So agree in advance:

Who calls whom — and in which order, outside office hours too.
Which logs go where — and how long they are kept.
Who may intervene — what the network partner may do on its own and what needs approval.

NOC with us, SOC with a specialist

Our NOC-as-a-Service monitors and manages your network and reports what happens. For detection and response on your servers and workstations you work with an MDR provider, and we supply that provider with the network side. The same goes for DDoS protection and IP transit: we do the network. The questions a NIS2 customer asks us are on our NIS2 page. Want to know what the handover looks like for your environment: get in touch.