Skip to content
Made in the UK

SIEM for MSPs

How do MSPs run a SIEM without a 24/7 SOC?

By , CEO, CybaVerse. Last reviewed

An MSP runs a SIEM without its own 24/7 SOC by pairing log collection and detection with an MDR service whose analysts triage alerts around the clock. The MSP owns onboarding, client relationships and recovery; the MDR provider watches, investigates and contains within pre-approved actions.

This page is part of our SIEM for MSPs guide.

Why is a SIEM on its own not enough for MSP clients?

A SIEM collects and searches logs, but it does not decide what matters or act at 3am. The NCSC notes that logging only helps security when someone reviews the data and acts on it. For an MSP with a small team, unread alerts across dozens of tenants create risk without protection.

  • Alerts fire at night and at weekends, when your engineers are off shift.
  • Each client has different sources, so rules need tuning per tenant.
  • Clients assume that "we have a SIEM" means "someone is watching".

How do MSPs set it up, step by step?

The workable model splits the job into collection, detection, triage and response, and gives each one a clear owner. Most MSPs keep collection and the client relationship, and hand round-the-clock triage to an MDR provider. Use the steps below as a checklist for each client you onboard.

  1. Step 1: Decide which sources matter for each client

    Start with identity, endpoint, email and internet-facing systems. These carry most of the signals an attacker leaves behind.

  2. Step 2: Collect and normalise the logs

    Send data into one platform and map it to a common schema such as OCSF, so one rule works for every client.

  3. Step 3: Apply tested detection rules

    Use a maintained rule set, such as the public SigmaHQ catalogue, then tune it to each client's normal behaviour.

  4. Step 4: Agree who triages out of hours

    Write down who reviews alerts at night, how they reach you and what they may do without asking.

  5. Step 5: Route cases into your PSA

    Cases should land where your engineers already work, with the evidence attached.

Who does what between the MSP and the MDR provider?

Clear ownership stops alerts falling between two teams. The table shows a typical split for an MSP using MDR rather than an in-house SOC. Agree it in writing per client, because pre-approved actions and escalation contacts differ by client and by system, especially for servers and critical services.

TaskMSPMDR provider
Client onboarding and data sourcesOwnsAdvises
Detection rules and tuningReviewsOwns
24/7 triage and investigationInformedOwns
Containment within pre-approved actionsApproves in advanceActs
Recovery and rebuildOwnsSupports

Where does CybaOps fit for MSPs running a SIEM?

CybaOps is the CybaVerse MDR platform, delivered through MSPs, backed by our UK-based security operations centre. It brings security log collection, normalisation, search and case management into one platform, so MSPs get searchable data for every client without staffing their own round-the-clock team.

  • CybaOps collects security logs from endpoints, firewalls, cloud and Microsoft 365 into one place.
  • CybaOps normalises security data to the open OCSF schema.
  • Analysts and partners can search and investigate across their data in CybaOps, with AI help to build queries.
  • CybaOps detection is being built on the open Sigma rule standard.
  • We are building a correlation engine into CybaOps that links related alerts into a single incident.
  • Incidents are worked as cases in CybaOps, so every alert, action and note sits in one record your team can see.
  • CybaOps works with the security tools you already have, including Microsoft Defender, Sophos and the other EDR tools you already use, so you do not have to rip and replace.
  • CybaOps offers configurable retention.
  • CybaOne adds SIEM, an external penetration test and dark web monitoring to everything in CybaEdge.

SIEM without a SOC

How an MSP runs a SIEM without its own 24/7 SOC

An MSP runs a SIEM without its own 24/7 SOC by pairing log collection and detection with an MDR service whose analysts triage alerts around the clock.

01 Log sources

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

SIEM without a SOC

02 The 5-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • SIEM in
  • CybaOne

What else do MSPs ask about running a SIEM?

Do clients need to replace their existing EDR?

No. CybaOps works with existing tools such as Microsoft Defender, Sophos and the other EDR tools you already use and brings their data alongside other logs.

Can I keep an existing Microsoft Sentinel deployment?

Ask any provider how it works alongside an existing SIEM before you decide.

Do I need security analysts on staff?

No. The CybaVerse SOC covers round-the-clock triage. Your engineers handle onboarding, approvals and recovery.

What should you do next?

  1. List which clients already send logs anywhere, and who reads them today.
  2. Pick two clients to start with and agree what good looks like.
  3. Book a CybaOps demo to see the workflow on real data.

See CybaOps | Become a CybaVerse partner

See the workflow on real data.

Book a CybaOps demo