By Abdulhakeem Ekun | Cybersecurity Researcher & PhD Candidate, University of Wolverhampton
“A physical person does not need to watch it all the time. But when something serious happens — the right person gets notified immediately.” That was the requirement. This is how I built it.
Platform Walkthrough
The Problem Nobody Talks About
Small and medium-sized businesses are being attacked at the same rate as enterprises. The difference is they don’t have a 15-person SOC team watching dashboards around the clock.
Most SMEs fall into one of two traps:
- They buy a firewall and call it “security”
- They outsource to a managed provider and have no visibility into what’s actually happening on their own systems
Neither of those is a SOC. Neither gives you an audit trail when something goes wrong. And in regulated industries like fintech, healthcare, legal, and the absence of that audit trail isn’t just a technical problem. It’s a compliance failure which is what I set out to fix.
Hero Banner
What Is SOCaaS?
SOC-as-a-Service (SOCaaS) is the idea that security operations, detection, triage, alerting, and response can be delivered as a managed, automated service rather than requiring a full team of analysts staring at screens.
The version I built is specifically designed for SMEs:
- Low cost:- built on open, well-established security tooling, deployable on a single server or VM
- Autonomous:- automatically triages alerts and only escalates what matters
- Audit-ready:- every incident is logged, timestamped, and case-managed
- Deployable anywhere:- containerised, runs on-premise or in the cloud
The Stack
[Endpoint Agents]
↓
[Detection Engine] ← Rule processing, file integrity monitoring, vulnerability scanning
↓
[Log Storage & Indexing] ← Centralised, searchable event history
↓
[Visualisation Layer] ← Dashboards for security, compliance, and threat hunting
↓
[Automation Engine] ← Severity triage, enrichment, case creation
↓
[Human Notification] ← WhatsApp / Slack / Email — critical alerts only
Every component runs in a container. The entire platform is designed to be stood up from a clean environment in a single deployment step.
Architecture Diagram
The SOC Portal
Rather than expect an analyst or client to remember five different service URLs and ports, everything now sits behind a single landing page, live threat level banner, service cards for each part of the stack, and one point of entry.
How the Autonomous Triage Works
Traditional SOC tooling fires an alert and waits for a human. Every alert, regardless of severity, lands in the same queue. Analysts spend most of their time on noise.
This platform does something different. Every alert is automatically classified by severity the moment it’s raised:
Alert received
↓
Critical severity?
├── YES → Enrich with threat intelligence + Create case + Notify analyst immediately
└── NO → Medium severity?
├── YES → Create case (logged, no immediate interruption)
└── NO → Log and discard (noise)
The result: a genuine critical event at 3am generates an immediate notification with full context of what happened, where, and a direct link to the case. A lower-severity event gets logged and case-managed without interrupting anyone’s day unless it escalates.
(The exact thresholds, enrichment sources, and automation logic are part of the managed deployment this diagram shows the concept, not the implementation.)
Detection Coverage
The detection engine is configured to cover the threat categories most relevant to SME environments:
Authentication & Access
- Brute force attacks (SSH, RDP, web applications)
- Multiple failed login attempts
- Successful login after multiple failures (credential stuffing indicator)
- New privileged account creation, account modification and deletion
System Integrity
- File integrity monitoring on critical system paths
- Rootkit detection
- Suspicious process execution
- Scheduled task and cron job creation
Network & Exfiltration
- Unusual outbound connection patterns
- DNS anomalies
- Large data transfer indicators
- Port scanning detection
Compliance
- PCI-DSS mapped rules (essential for fintech environments)
- Audit log tampering detection
- Vulnerability scanning against known CVE feeds
Security Dashboard Screenshot
Case Management
Every alert that reaches the notification threshold doesn’t just fire a message and disappear it creates a structured incident case, complete with:
- Full alert details
- Enriched threat intelligence context
- Assigned severity and response timer
- Evidence log for audit purposes
- Analyst action history
For a fintech client, this is non-negotiable. When an auditor asks “show me how you handled the incident on the 14th” the case is there, timestamped. Complete.
Case Management Screenshot
Threat Intelligence Enrichment
Raw alerts tell you what happened. Threat intelligence tells you who did it and how serious it is.
Before creating a case or firing a notification, the automation pipeline enriches every alert with external threat intelligence source IP reputation, geolocation, and confidence scoring. An analyst receiving a critical alert doesn’t just see a raw IP address they see its reputation, how recently it’s been reported, and where it originates. That context changes how fast you can make a response decision.
Compliance Dashboards
For SME clients especially in fintech, compliance isn’t optional. The dashboards built into this platform are mapped to regulatory frameworks:
- PCI-DSS Dashboard:- cardholder data environment events, access control failures, system change events
- Security Overview:- alert volume over time, severity distribution, top triggered rules, agent health
- Authentication Dashboard:- failed/successful login attempts, top offending source IPs, geographic login distribution
- Threat Hunting Dashboard:- rare process executions, unusual parent-child process relationships, scheduled task anomalies
Compliance Dashboard Screenshot
The Notification Pipeline
A SOC is only as good as its escalation chain. This platform supports multiple notification channels, each serving a different purpose, an immediate mobile alert for the on-call analyst on critical events, a team channel notification for general awareness, and a formal email record for the audit trail.
The messages contain the context an analyst needs to make an immediate decision without logging into a dashboard first.
Recently Shipped
- Unified SOC portal:- single landing page for navigating all services, with live status indicators
- System hardening:- direct access to internal services locked down, only the portal is exposed
- Multi-sector rule architecture:- fintech rule set live, healthcare and legal in progress
What’s Coming Next
The platform is production-ready for initial deployment, but security is never finished. The roadmap includes:
Active Response Integration When a brute force attack is confirmed, the system doesn’t just alert, it automatically blocks the source IP. Zero human intervention required for initial containment.
MITRE ATT&CK Mapping Every detection rule mapped to a MITRE ATT&CK technique, with dashboards showing detection coverage across the matrix.
Network Intrusion Detection Adding network-level detection alongside host-based detection, catching threats at the wire level before they reach endpoints.
Automated Threat Hunting Scheduled workflows that proactively hunt for indicators of compromise, rather than only reacting to alerts as they fire.
Multi-Tenant Support Separate dashboard views and alert pipelines per client, essential for monitoring multiple organisations from a single platform.
Mobile SOC App A lightweight app for analysts to triage and respond to cases from their phone.
The Bottom Line
A fintech company with 50 employees cannot afford a SOC team. But they also cannot afford a breach, the regulatory consequences alone can be company ending.
This platform provides something in between: continuous monitoring, automated triage, enriched alerting, and a full audit trail.
The project is under active development. If you’re an SME, an MSP looking to add SOC capabilities to your offering, or a security professional building out your portfolio, get in touch below.
Abdulhakeem Ekun is a PhD researcher in Cybersecurity at the University of Wolverhampton, ranked 4th in the UK on Blue Team Labs Online, and an IT Lecturer at Dudley College of Technology. His research focuses on AI-augmented firmware security for Linux-based embedded devices.