Skip to content
LogSeam

The SOC is a set of teams, all using different tools.

Its functions are meant to feed each other around the clock, but each one runs on its own tools and its own data. LogSeam puts them on one system you compose with tasks, with your people making the calls.

A ring of glass columns stands around one woven disc, each joined to it by threads of light.
where to look new rules new sources alerts cases exposure evidence findings incidents outcomes priorities

On paper, a SOC is a loop.

Triage takes the first look at every alert. Investigation works out what happened. Incident response scopes it and hands the action back to the customer. Threat intelligence says what to watch for. Detection engineering turns that into rules. Threat hunting looks for what the rules miss. Forensics works out what a file or a process did. Vulnerability management says where you're exposed. Source coverage makes sure the logs are there to look at. Reporting shows whether any of it is working. Each one is meant to feed the others: a hunt becomes a detection, an investigation sharpens the next rule, intel reaches every case. All of it, around the clock.

In practice, the SOC you get depends on who you can hire.

Threat intelligence Tool Team
Threat hunting Tool Team
Source coverage Tool Team
Detection engineering Tool Team
Triage Tool Team
Vulnerability management Tool Team
Investigation Tool Team
Forensics Tool Team
Incident response Tool Team
Reporting Tool Team
Ticket Ticket Ticket Ticket Ticket Ticket Ticket

The few who can staff it.

Each function became its own team, with its own tools, its own data and its own queue. The handoffs that were meant to happen on their own became tickets and meetings, and it takes a budget only the largest organizations can carry.

MDR Its own tools, team and playbook Alert queue
Motivation
Manage alerts across all its customers
Delivers
Escalations to your team
Threat intelligence Not staffed
Threat hunting Not staffed
Source coverage Not staffed
Detection engineering Not staffed
Triage Not staffed
Vulnerability management Not staffed
Investigation Not staffed
Forensics Not staffed
Incident response Tool Team
Reporting Not staffed

Everyone else.

A small team does the first look and the response, and everything past that waits. Many hand the alerts to an MDR, but an MDR is a business of its own, with its own tools, team and playbook. Its motivation is managing alerts across all its customers, and what it delivers is escalations. Hunting, detection engineering and intel stay unstaffed in your SOC, and the logs a hunt would need are the first thing cut from the bill.

Attackers don't check which functions you staff.

Why adding more doesn't close the gap

  1. Hire a team for every function.

    The people are scarce, and each new team brings its own tools.

  2. Outsource to an MDR.

    It works to manage alerts across all its customers and delivers escalations. The functions your SOC needs still aren't staffed, and your team ends up further from the work.

  3. Add an AI tool to the queue.

    The first look gets faster, but the tool sits on your SIEM and sees only what the SIEM kept.

LogSeam

Threat hunting

Question
Has this happened before, in any year we kept?
Action
Run the hunt across every year of logs you keep.
Outcome
A finding, a new detection, or a gap in what you collect.

What a modern SOC needs.

Going forward, a SOC can't be defined by how many functions you can staff. It has to be defined by what one system can do, and what your people decide.

  1. The functions you couldn't staff, in one platform.

    Triage, investigation, forensics, threat intelligence, detection engineering, threat hunting, source coverage and reporting run together, with your vulnerability data alongside and the investigation's findings kept on the case for whoever runs the response. The SOC you run isn't limited to the teams you could hire.

  2. Functions that feed each other.

    They work from one copy of your logs, and tasks carry the work between them: a hunt's finding becomes a detection, new intel is checked against past logs, and each new investigation starts with the earlier cases that share its users and addresses. Nothing is re-explained in a ticket.

  3. Scale that's the platform's problem.

    Every source is kept, 10 to 20 times smaller, and searched the same way years later. A years-wide question doesn't wait on a cluster someone had to size, and because pricing is by the node, no source is dropped to fit the bill.

  4. A SOC you compose.

    Tasks are standing orders written in plain language, run once or on a schedule: what detection engineering does every morning, how intel gets curated, the shape of a weekly hunt. Compose them into the way your organization works, not a vendor's playbook.

  5. The agents do the reading. Your people make the calls.

    Agents triage every alert around the clock, build the case, investigate it and show every step. Your people decide what goes live, what happens next and the verdict on every case.

Not a bigger SOC, and not a black box. A connected one.

MDR Its own tools, team and playbook Alert queue
Motivation
Manage alerts across all its customers
Delivers
Escalations to your team
LogSeam
where to look new rules new sources alerts cases exposure evidence findings incidents outcomes priorities Ticket Ticket Ticket Ticket Ticket Ticket Ticket

Threat hunting

Question
Has this happened before, in any year we kept?
Action
Run the hunt across every year of logs you keep.
Outcome
A finding, a new detection, or a gap in what you collect.

What the agents do. What your people decide.

FunctionThe agentsYour team
Triage

Read every rule match and write down why each one was kept or held back.

Reads what triage held back, and why, until it trusts the calls.
Investigation

Group related alerts into one case and start the investigation on their own, every claim linked to its logs.

Approves the next steps and sets the verdict.
Incident response

Carry the investigation from source to source and keep the findings on the case.

Runs the response.
Threat intelligence

Check new indicators against your past logs, on a schedule or when asked.

Decides which intel matters.
Detection engineering

Write rules for your sources and test them on past logs.

Reads how each rule did on past logs, then switches it on.
Threat hunting

Run hunts across every year of logs you keep, on a schedule or when asked.

Decides where to look and what a finding means.
Forensics and malware analysis

Specialists for forensics and malware, brought in by the Assistant when you ask.

Decides what the evidence means.
Vulnerability management

Read your vulnerability data, from tools like Tenable, alongside your logs.

Fixes what's exposed.
Source coverage

Recognise each source on arrival and write detections for every one you connect.

Chooses which sources to send.
Reporting

Write reports from the cases, rules and spend on the record, on a schedule or when asked.

Decides what goes to the board.

How you get there

  1. Hand the agents the first look,

    and read what they hold back until you trust it.

  2. Add the functions you've never been able to staff,

    one task at a time: detections for your sources, hunts, intel checks.

Questions buyers ask

Is LogSeam an MDR?

No. It's the platform your SOC runs on. Your team, or a partner you choose, makes the calls.

Do we need a team for every function?

No. You need people who can judge the evidence and make the call, not a specialist team doing each function's work. Start with the functions you're thinnest in.

What if an agent gets it wrong?

Every step it took is on the record with its evidence, and everything triage holds back keeps its reason, so your team can check any call. Rules it writes stay off until someone switches them on.

How do we make it work the way our SOC works?

With tasks: standing orders in plain language that run once or on a schedule. Write a discipline down once and it runs the same way every time.

How is this different from an AI SOC tool?

Most sit on top of a SIEM and see only what it kept. LogSeam holds the logs, so the agents work across every source you send.