> For the complete documentation index, see [llms.txt](https://cybrhawksoc.gitbook.io/cybrhawk-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybrhawksoc.gitbook.io/cybrhawk-docs/soc-analyst-guide/customer-operational-guide.md).

# Customer Operational Guide

***

**Overview**

This document outlines your operational responsibilities based on your CybrHawk service subscription. We offer two primary service models to match your organisation's security maturity and resource availability.

| Service Tier                  | Primary Purpose                                                                                         | Key User Responsibility                                                             |
| ----------------------------- | ------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
| **Managed SOC Service**       | Full security operations outsourcing. Our team manages detection, triage, and initial response.         | **Respond to Escalations** - Review and act on critical requests from our SOC.      |
| **SIEM/SecOps Platform Only** | Self-managed security operations. You retain full control of detection and response using our platform. | **Daily Triage** - Actively monitor and manage security alerts within the platform. |

***

#### **1. For Managed SOC Customers**

**Your Role: The Incident Commander**

When you subscribe to our Managed SOC service, our security analysts become an extension of your team. We handle the 24/7 monitoring, investigation, and initial containment, allowing you to focus on strategic business decisions.

**Primary Responsibility: Respond to Escalations**

* You will receive critical notifications via **email** or **phone** when our SOC requires your input or action.
* These escalations are typically for:
  * **Validation:** "We see a critical action from user \[X]. Is this authorized?"
  * **Action:** "We have contained a threat on endpoint \[Y]. Please inform the user."
  * **Decision:** "An incident has been declared. Activate your incident response plan."

**Technical Requirement:**

* **No daily login to the platform is required.**
* You only need to monitor the communication channels (email/phone) used for escalations.

**Strong Recommendation: Leverage the Platform for Awareness**

While not mandatory, logging into the **Security Dashboard** provides significant benefits:

* **Operational Awareness:** View real-time security posture, active incidents, and threat trends.
* **Skill Uplift:** Observe how our analysts investigate and respond to threats—a free training resource for your team.
* **Proactive Oversight:** Access customized reports and dashboards for compliance and management reviews.

> **Best Practice:** We recommend a daily login to review the **Security Posture Dashboard** and any closed incident reports to maintain situational awareness.

***

#### **2. For SecOps/SIEM Platform Only Customers**

**Your Role: The Security Operator**

With the SIEM Platform, your team is in full control of your security operations. The platform provides the tools and intelligence, you provide the analysis and response.

**Primary Responsibility: Daily Alert Triage.** You must actively manage the security alerts generated by the platform. This can be done through two primary methods:

**Method 1: Direct Console Login (Recommended)**

1. Log in to the **CybrHawk Security Dashboard** daily.
2. Navigate to the **“Security Detections”** queue.
3. **Triage Alerts:** Review, investigate, and action each alert by:
   * **Closing** false positives.
   * **Escalating** true positives to your IT team for remediation.
   * **Adding notes** for audit trails.

**Method 2: Email Alert Monitoring (Minimum Requirement)**

* Ensure **email alerts are enabled** for your security team.
* Review all email notifications for new detections.
* **You must log in to the console to fully investigate and close alerts.** Email is for notification only.

**Technical Requirement:**

* **Daily interaction with the platform is required** to maintain security efficacy.
* Your team is responsible for the end-to-end process: Detection → Triage → Response → Closure.

***

#### **Summary of Responsibilities**

| Action                     | Managed SOC Customer    | Platform Customer                                  |
| -------------------------- | ----------------------- | -------------------------------------------------- |
| **24/7 Monitoring**        | Handled by CybrHawk SOC | Your Responsibility                                |
| **Initial Alert Triage**   | Handled by CybrHawk SOC | **Your Responsibility**                            |
| **Respond to Escalations** | **Your Responsibility** | Not Applicable (except active hunts and zero-days) |
| **Daily Platform Login**   | Recommended (Awareness) | **Required** (Operation)                           |
| **Email Alert Review**     | For escalations only    | Minimum requirement for notifications              |

***

#### **Getting Started Checklist**

**For Managed SOC Customers:**

* [ ] Provide emergency contact details for escalations.
* [ ] Bookmark the CybrHawk Customer Portal.
* [ ] Schedule a monthly review meeting with your assigned analyst.

**For SIEM Platform Only Customers:**

* [ ] Designate primary analysts for daily triage.
* [ ] Configure email alert recipients.
* [ ] Complete CybrHawk Analyst Console training.
* [ ] Establish an internal workflow for alert response and closure.

**Need Help?** Our support team is here to assist with:

* Technical configuration and onboarding.
* Analyst training for the platform.
* Defining escalation workflows.

**Contact Support:** <socv2@cybrhawk.com>

***