SOC monitoring and service coverage
Understand human triage, contact readiness, deployment connectivity, and separate service targets.
Guard's security operations center (SOC) provides 24/7/365 human-reviewed alert triage. The SOC reviews received telemetry, correlates activity, and guides the organization through its agreed response process.
Establish contacts and authority
At Organization → Contacts → Incident escalation, add a primary responder, backup, service owner, and approved urgent contact methods. Test the escalation path through Contacts → Test escalation. Keep after-hours contacts current; an unanswered message does not authorize unrestricted disruptive actions.
At Organization → Response controls, review which actions the SOC can propose and which it can execute under an explicitly approved playbook. Policy recommendations, incident ownership, and automatic containment are different authorities. No blanket execution authority is implied by monitoring coverage.
Understand coverage targets
The service targets use separate clocks and coverage boundaries:
| Service | Coverage |
|---|---|
| Threat intelligence | Continuous updates with sub-hour indicator refresh |
| DDoS activation | Automatic; target under 60 seconds from detection for admitted protected traffic |
| SOC triage | Human-reviewed, 24/7/365 |
| Scanning | Weekly automated scans; quarterly authenticated coverage reviews |
| Penetration testing | Annual engagement plus on-demand arrangements |
| Alert and log history | 13 calendar months by default |
These describe different measurements. A support response target is acknowledgement, not confirmed containment or application restoration. Standard, Premium, and Enterprise support have separate pricing and response coverage.
Hosted and self-hosted visibility
Hosted telemetry uses the organization's enabled collectors. A self-hosted installation can run local controls without a DDoS Connector, but remote human triage requires an enabled SOC collaboration channel and approved data sharing. Configure it at Organization → SOC → Collaboration, select shared event categories, and verify Connection status.
An isolated installation cannot send new alerts to a remote SOC while disconnected. Local policies and investigations remain available according to local health; the coverage view reports the collaboration gap. Reconnected backlog is historical evidence, not proof the SOC observed it in real time.
Escalate an active incident
Use Incident → Escalate to SOC and the urgent contact shown in the organization's support details. Include incident and request IDs, affected services, observations, and impact. Do not include secrets. Follow the relevant runbook while waiting for coordination and record decisions in the incident timeline.