SIEM
Collect from syslog, HTTP and cloud connectors into OpenSearch. A correlation engine with Sigma rules turns raw events into alerts.
Managed SOC · Unified SIEM platform
One SOC. Every signal.
Contained before it spreads.
INSEC SOC brings SIEM, EDR, behaviour analytics, DLP and asset intelligence into a single portal, with an AI hunter that triages while your analysts sleep.
- 5products in one portal
- 24/7AI-assisted triage
- Multi-tenantbuilt for MSSPs
The platform
Everything a SOC needs, already connected
Most stacks are five tools stitched together. INSEC SOC is one platform where every product shares the same intelligence.
EDR
Endpoint visibility and live response on Velociraptor: process trees, hunts and one-click containment with revert.
ShadowWatch UEBA
Learns normal behaviour for every user and host, then surfaces insider threats and account takeover that rules miss.
KnightProtect DLP
Stops sensitive data leaving through USB, email, web and clipboard, with policies tuned per tenant.
EAE Assets
A live asset inventory and vulnerability view, so every alert arrives with business context.
Hive AI
The Knowledge Hive shares findings across all products. The AI hunter investigates, drafts detection rules for approval, and never auto-closes a critical alert.
From signal to resolution
Alert to contained incident in one place
- 01
Collect
Agents, syslog and API connectors feed one tenant-isolated data lake.
- 02
Correlate
Detection rules and behaviour models raise alerts, scored and mapped to MITRE ATT&CK.
- 03
Triage with AI
The AI hunter adds a verdict, a summary and related IOCs. Analysts override any call.
- 04
Respond
SOAR playbooks, cases and EDR containment run from the same screen, with a full audit trail.
Built for the Kingdom
Security that keeps your data, and your regulators, in view
Saudi organisations need a SOC that respects data residency and works for local partners. This is how INSEC SOC is designed.
Deploy inside the Kingdom
The platform is self-hosted, so telemetry and evidence can stay on infrastructure you choose in Saudi Arabia.
One platform for local MSSPs
Multi-tenant by design: one SOC serves many customers with isolated data, licences and roles.
Evidence for your compliance programme
Compliance evidence and PDF reports you can map to NCA ECC, SAMA CSF and PDPL controls with your assessor.
Bilingual from the first click
This site and onboarding are available in English and Arabic.
Plans
Start with SIEM, grow into the full suite
Starter
SIEM-only entry tier with Hunt enabled and limited quotas.
- SIEM
- Hunt
Professional
EDR and asset management with SOAR, Hunt, file integrity and posture.
- SIEM + EDR + EAE
- SOAR · FIM
Enterprise
The full product suite with every feature flag enabled.
- SIEM + EDR + UEBA + DLP + EAE
- Hive AI
MSSP
Multi-tenant scale for providers: all products and flags across many customers.
- All products
- Tenant management
One sign-in
Everyone logs in here and lands in the right place
Platform admins
Control centre: tenants, licences, connectors, feeds and platform health.
Tenant admins
Your organisation: users, roles, products, reports and billing.
Analysts and users
The SecOps Center: alerts, incidents, hunts and cases for your tenant.