How real-time threat detection works in a SOCaaS model
Cyber incidents are getting faster. Attacks are now measured in minutes and seconds, not hours and days. Recent data shows that once hackers get in, they can move through systems and spread to other parts of a network in less than 30 minutes.
The only way to protect your organisation against these sophisticated threats is through constant vigilance and real-time threat detection and response. The difference between responding immediately and an hour later can be the difference between a minor alert and a major breach.
Real-time threat detection allows an organisation to continuously monitor its environment, identifying and containing threats the moment they occur. This reduces dwell time (the time an attacker sits in your network), meaning the attackers have less time to explore your network and compromise systems.
Evalian’s SOCaaS (learn the difference between SOC and SOCaaS) uses Microsoft Sentinel to achieve real-time threat detection in our customer environments. Sentinel is a Security Incident and Event Management (SIEM) solution, used to collect, correlate and corroborate security signals.
Our analysts leverage built-in machine learning and threat intelligence to detect suspicious behaviour, continually performing threat modelling and hunting to create and tune custom detection rules, alerting us the moment an attack occurs.
SOC, SIEM, MDR, XDR – what do they mean?
How real-time threat detection works in SOCaaS
The foundation of any effective real-time detection lies in how well a SOC can collect, normalise and analyse data from across an organisation’s estate.
In our SOCaaS model, this process happens 24x7x365, ensuring that every activity, log or event that could signal a potential threat is captured in near real time.
We use Microsoft Sentinel data connectors to collect logs across all endpoints, including servers, cloud applications, firewalls and identity systems. When a particular data source does not have a pre-built data connector, Evalian builds custom data ingestion pipelines to ensure all logs are collected.
Once connected, these sources continuously stream logs and security events into Sentinel’s analytics engine in near real time (NRT). This seamless data ingestion process enables Evalian to maintain a live, unified view of our customers’ threat landscape, forming the first critical step in detecting attacks as they unfold.
Microsoft Sentinel Rule Types
Once data is ingested, it can be analysed by any of the out-of-the-box and our own custom analytical rules or correlation logic. Sentinel supports many different types of rules to effectively monitor your environment.
Analytical Rules
Analytical rules are the main rules within Sentinel and are custom-built depending on an organisation’s environment and data sources. These rules run on a set time period or near real time, allowing for continuous monitoring.
Sentinel comes with many prebuilt rules for Microsoft Security; these automatically generate incidents based on alerts from other Microsoft products such as Microsoft Defender for Endpoint and Microsoft Defender for Office 365.
These rules cover a broad range of attack vectors such as logons from a risky IP address, impossible travel and malware detection. Defender is constantly scanning the device to check for suspicious files and activity.
Evalian’s SOC analysts work to enhance the prebuilt detections and build custom detections bespoke for customer environments by identifying a baseline set of activities to identify suspicious activity outside of the norm. This is crucial for catching threats that aren’t covered by Microsoft’s out-of-the-box rules.
This bespoke approach allows Evalian to detect targeted attacks or insider threats specific to our customers and their infrastructure that don’t match Microsoft’s predefined patterns. Filtering out noise by focusing on what is genuinely unusual for that organisation.
Fusion Rules
Fusion rules are used to detect multi-stage, cross-domain or sophisticated attacks using machine learning. By correlating related alerts across different data streams and timeframes, fusion rules can uncover hidden relationships that indicate a coordinated or evolving attack campaign.
For example, what might appear as isolated login anomalies, privilege escalations, and data transfers could be connected to reveal a larger, ongoing breach.
User and Entity Behaviour Analytics (UEBA)
User & Entity Behaviour Analytics (UEBA) works by building behavioural baselines for users, devices and entities. This baseline sets the standard for what is normal activity for these assets, which then allows the UEBA rules to flag anomalies in real time.
This type of alert reduces a SOC’s reliance on static rules, allowing greater coverage.
Threat Intelligence Rules
Threat intelligence-backed detection rules are used by our SOC and are designed to identify and respond to malicious activity in real time. These rules continuously reference a regularly updated database of known indicators of compromise (IoCs), such as malicious IP addresses, domains, file hashes and URLs.
Incidents are automatically generated whenever a match is detected within a customer environment. These types of detections provide Evalian with enhanced visibility, faster detection and reduced risk exposure.
Security orchestration, automation and response
Evalian leverage Security Orchestration, Automation & Response (SOAR) capabilities to streamline and accelerate our security operations. This allows our SOC to automatically respond to potential threats, significantly reducing the time required to contain or remediate incidents.
Rather than having analysts manually investigate every alert, our SOAR approach automates repetitive and routine tasks through predefined logic, integrated tools, and coordinated workflows.
For example, if a suspicious sign-in is detected from an unfamiliar location, our automated processes can immediately act by blocking the IP address, disabling the affected user account, and notifying the SOC team.
Deploying detections as code
Evalian’s detections are deployed as code within GitHub, ensuring that all detection logic is version-controlled, peer-reviewed, and continuously improved. These detections are then automatically ingested into Microsoft Sentinel, providing customers with a consistent, up-to-date, and scalable threat detection framework.
This approach enhances transparency, enables rapid iteration in response to emerging threats, and reduces human error by automating deployment workflows.
By integrating this process into the SOC, Evalian deliver real-time threat detection that evolves alongside our customers’ threat landscape, ensuring customers benefit from faster detection, greater accuracy, and continuous improvement of their security posture.
Threat hunting and continuous improvement
Alongside these detection rules, threat hunting is also performed by our SOC to proactively search for indicators of compromise or suspicious behaviour. Instead of waiting for alerts to trigger, analysts search through logs to uncover signs of compromise that may have slipped past automated detections.
Evalian aligns the threat hunting approach to the MITRE ATT&CK framework, ensuring complete visibility across the attacker lifecycle. By leveraging unified workspace queries within our environment, Evalian can hunt at scale across customer datasets.
This process is combined with up-to-date threat intelligence feeds to identify new IoC’s and adversary tactics in real time. This continuous hunting process not only helps detect sophisticated attacks that may evade traditional point controls (e.g., local endpoint protection) but also strengthens detection logic over time.
Understanding log ingestion delays
While Microsoft Sentinel enables near real-time detection, it’s important to recognise that some log ingestion delay is inherent in any cloud SIEM. Depending on the data connector, source system, and ingestion method, logs may take a few seconds to several minutes to appear in Sentinel after being generated.
For example:
- Microsoft Defender for Endpoint and Entra ID (Azure AD) logs typically arrive within 30-90 seconds.
- Azure activity logs may take 2-5 minutes.
- Syslog-based or third-party connectors (such as firewalls or GCP logs) can have longer delays due to network transport, API throttling, or normalisation overhead.
To monitor and mitigate this, Evalian’s SOC engineers maintain custom Sentinel workbooks and detections that track ingestion latency by comparing the event’s original TimeGenerated value to its TimeReceived timestamp.
These insights allow the team to quickly identify delayed sources, connector issues, or data gaps across tenants.
Where delays are expected, such as from API-based or external connectors. Evalian’s SOC compensates by correlating events once ingestion completes, ensuring that no relevant telemetry is missed during analysis.
For high-priority use cases such as credential compromise or malware execution, Evalian prioritises low-latency data sources and near real-time (NRT) analytic rules, enabling detections to trigger as quickly as the data becomes available.
Enquire about SOCaaS
Our SOC as a Service combines Microsoft Sentinel with expert threat hunters to expose phishing, credential theft and lateral movement before impact.
Learn what Evalian’s CREST accredited SOC as a Service includes
Contact us to discuss your organisation’s requirements. Or for help in what to look for when choosing a SOC provider, download our free guide and checklist.
Want to go a step further and understand the true cost of building a SOC in-house vs using a hybrid or fully outsourced SOC? Read our latest article on the Cost of a SOC, or skip straight to our SOC Cost Calculator.
