Cybersecurity
A SIEM is a platform that stores and correlates logs. A SOC is the people, hours, and procedure that act on those events. Buying or integrating the platform does not create the staffed center. Novatelia publishes the SIEM design and a managed-security scope that must be written down. A round-the-clock operations center is not a published offer.
Revised 2026-10-10. Published by Novatelia. No individual author is named, because no personal credential is claimed for this explanation.
Key points
- The platform and the operating model are different purchases.
- Hours exist only in a written engagement.
- An alert queue without an owner is not a SOC.
Definition
Use SIEM when the requirement is collection, search, and correlation. Use SOC language only when a document names the people, the hours, and the actions they are allowed to take.
How it works
The platform produces events. A documented queue says who reads them, in which hours, and which actions are in scope. Without that document, the organization has a tool, not a center.
Architecture
- Platform: the SIEM and its log sources.
- Queue: the events a named role will actually review.
- Boundary: what the engagement will not do, including hours that were never written.
Use cases
- A buyer is comparing a software license with a staffed service.
- A project has logs but no named person to read them.
- A tender uses SOC language and needs the scope separated from the tool.
Comparison
- SIEM
- Software, storage, parsers, and correlation rules.
- SOC
- People, hours, and a procedure. Not published here as a round-the-clock center.
Selection guidance
- Ask whether the requirement is a tool or a staffed service.
- Do not treat a product page as an operating-hours commitment.
- Put any monitoring hours in the managed-security engagement, and only if they are written.
Questions
Can the same project include both?
Yes. The platform can be deployed and a separate engagement can name who reviews events. The two scopes stay separate so a software license is not mistaken for a staffed center.
Does Novatelia publish a 24/7 SOC?
No. Managed security on this site is administration of named platforms. Hours, if any, exist only in a written agreement. A round-the-clock center is not offered.
Related
More in Cybersecurity
This page defines a term so a project can be scoped. It is not a certification, a test result, or a price. Partnerships are stated only on the partners page. The published address and telephone are the company contact, not a service-level commitment.
Describe the requirement
An RFQ saves a browser draft. It does not publish a price or issue a quotation reference.