SOC services in Dubai, UAE
SOC services in Dubai: a security operations centre that monitors your systems 24x7, validates which alerts are genuine incidents, and contains confirmed threats. Run on the Fortinet Security Fabric, with your telemetry processed and retained in the UAE.
Why detection tooling needs a SOC behind it
Detection platforms generate alerts. Whether an alert becomes a contained incident depends on whether an analyst is rostered to examine it when it arrives, and whether that analyst is authorised to act.
Security operations also requires staffing three shifts through weekends and public holidays, keeping detection rules current as systems change, and holding the authority to disconnect a system outside business hours.
A managed SOC provides that staffing, tuning and authority as a service, in addition to the platform.
What a managed SOC covers
Monitoring is the visible part of a SOC. The response, hunting, detection content and reporting arranged around it determine whether an incident is contained.
SOC services we operate
Not every organisation needs every layer on day one. Scoping identifies which of these services your environment requires and which would duplicate coverage you already have.
24x7 SIEM monitoring
FortiSIEM correlates events from cloud, network, identity and endpoint sources in real time, with analysts investigating what the correlation surfaces before escalation.
Endpoint detection and response
FortiEDR and XDR provide behavioural blocking of ransomware, credential theft and fileless attacks, acting on behaviour without waiting for a signature.
Network detection
FortiNDR analyses east-west traffic and user behaviour inside the network, where an intrusion spends most of its time.
Email and deception
FortiMail and FortiDeceptor extend detection to the email delivery route most intrusions use, and to decoys that produce a high-confidence signal when touched.
Automated containment
Shuffle SOAR executes pre-approved playbooks on confirmed threats, isolating endpoints and revoking credentials in seconds.
Open automation platform
Shuffle carries over 300 integrations and no per-playbook licensing, so automation coverage is decided by what is useful.
Incident response hours included
Bundled IR hours come with the service, 20 on Advanced and 80 on Sovereign, so forensic work during a confirmed breach is covered under the agreement.
Post-incident reporting
Incidents are tracked against MITRE ATT&CK from detection through recovery to a root-cause report written for readers outside the security team.
Threat hunting by L3 analysts
Analysts work in three tiers: L1 and L2 validate and escalate, and certified L3 analysts run hypothesis-driven hunts for indicators that no rule has flagged, which is where dwell time is reduced.
MITRE ATT&CK coverage
Detection coverage is mapped to ATT&CK techniques and reported, so gaps are documented and can be addressed.
Threat intelligence
FortiGuard Labs intelligence augmented with commercial feeds and sector-specific ISAC data, focused on adversaries active in the GCC.
Detection engineering
Rules, use cases and correlation logic developed and tuned against your environment as it changes and as new techniques appear in the region.
Multi-cloud visibility
AWS Middle East, Azure UAE and local sovereign clouds monitored through one view, covering misconfiguration, identity abuse and unauthorised data movement.
Data residency
Security telemetry is processed and held inside UAE jurisdiction, which is a requirement under the PDPL for some organisations and a procurement condition for others.
Compliance evidence packs
Monthly reporting includes the evidence an assessor asks for, mapped to the framework you report against.
Co-managed authority
On Sovereign, your team retains defined authority over containment actions, so automation runs inside limits you set.
The frameworks SOC reporting has to satisfy
UAE regulation sets specific requirements for monitoring, logging and incident evidence. Reporting is mapped to the control being examined, so an audit is a retrieval exercise.
NESA and the UAE Information Assurance Standards
The IAS expects continuous monitoring, retained logs and demonstrable incident handling. Events are mapped to the relevant controls as they are generated, and the monthly pack contains the evidence itself.
DESC ISR
Dubai government and semi-government bodies are examined on detection coverage, response times and closure. Incident records run from first detection to root cause in a form an assessor can follow.
UAE PDPL and data residency
The Personal Data Protection Law shapes where telemetry may be processed and how long it may be held. Security data stays inside UAE jurisdiction.
SAMA CSF, NCA ECC, ISO 27001 and PCI DSS
Financial, Saudi-regulated, certified and cardholder environments each require monitoring evidence on their own cycle. Reporting is mapped to whichever set applies.
How the SOC runs
Telemetry is connected from cloud platforms, on-premises networks, identity providers and endpoints, so that correlation happens across sources.
- Log sources agreed against what each one contributes to detection
- Coverage gaps documented at the start, so that unmonitored sources are known
- Retention set against the framework you report on
FortiSIEM correlates events and filters false positives, so that analysts spend their time on validated incidents.
- Baseline detections in place from around day 30, tuned to your environment by about day 90
- Triage tuned against your normal behaviour, as normal activity differs between organisations
- Mean time to detect and mean time to respond reported monthly, so MTTD and MTTR are tracked as a trend
- Only validated, high-fidelity incidents escalated to your team
Certified analysts confirm what the platform surfaces and hunt for what it did not, working from hypotheses about attacker technique.
- Hypothesis-driven hunts run against MITRE ATT&CK techniques seen in the region
- Findings fed back into detection content, so that a hunt result becomes a rule
- Quarterly hunting on Advanced, monthly with ATT&CK coverage reporting on Sovereign
Confirmed threats trigger pre-approved playbooks, and the permitted actions are agreed with you before any playbook is authorised to run unattended.
- Containment scope agreed in advance, so that no business-critical system is isolated without prior agreement
- Bundled IR hours cover hands-on forensic work, 20 on Advanced and 80 on Sovereign
- Root-cause report issued after the incident, written for readers outside the security team
Why choose iConnect for SOC services
Telemetry that stays in the UAE
Security data is processed and retained inside UAE jurisdiction, which addresses the residency question during procurement.
One integrated fabric
FortiSIEM correlates natively from FortiEDR, FortiGate, FortiNDR, FortiMail and FortiDeceptor, which shortens onboarding and improves correlation.
Automation without per-playbook fees
Shuffle carries no per-playbook fee, so the number of automated responses is decided by what is worth automating.
Response hours in the contract
Bundled IR hours mean a confirmed breach is handled under the existing agreement, with 20 hours on Advanced and 80 on Sovereign.
Authority retained by your team
The co-managed model on Sovereign leaves your team in control of what may be contained automatically and what needs a human decision.
Audit evidence as standard
Events are mapped to NESA, DESC ISR, PDPL and the other applicable frameworks as they are logged, so the evidence pack is assembled as the SOC runs.
Sectors we monitor
What has to be monitored, how quickly it has to be contained and what the regulator expects to see differ by sector.
Government
DESC ISR reporting, data residency and an incident trail an assessor can follow.
Banking and Finance
SAMA CSF and PCI DSS evidence, with payment environments monitored separately.
Healthcare
ADHICS scope, clinical systems and connected devices that cannot be taken offline.
Manufacturing
IT and OT monitored to different tolerances, because production systems cannot be isolated without planning.
Retail and E-commerce
Payment systems and store networks, monitored through trading peaks.
Education
Shared networks, student data and a large unmanaged device population.
What our clients say
“Whenever an issue arises, iConnect is there immediately: quick, efficient and proactive in keeping everything running without disruptions. iConnect has become a crucial part of our operations.”
Head of IT Infrastructure and Network SecurityDragon OilFrequently asked questions about SOC services
The two terms overlap and are used differently by different vendors. MDR usually means detection and response on the endpoint estate, delivered on the provider's tooling. A managed SOC covers a wider surface, taking telemetry from network, identity, email and cloud sources alongside endpoints, and can be co-managed so that your team keeps authority over actions on your systems. When comparing services, the points to check are which data sources are ingested, who may take a containment action, and how quickly that action happens outside business hours.
Cover depends on the tier. Essentials provides 8x5 monitoring with 24x7 alerting, for organisations that want cover without an out-of-hours decision path. Advanced and Sovereign both provide 24x7 monitoring and response, with an analyst monitoring your environment outside your working hours and authorised to act on it.
Security telemetry is processed and retained inside UAE jurisdiction. This is relevant under the UAE Personal Data Protection Law and for public sector bodies with residency obligations. iConnect monitors AWS Middle East, Azure UAE and local sovereign clouds through a single view.
The managed SOC is operational from around day 30, by which point log sources are connected, baseline detections are in place and the first playbooks are running. Tuning is completed by about day 90, once normal behaviour in your environment has been recorded for long enough to be distinguished from suspicious activity. Tuning requires live traffic to learn from, so full detection value is not available on day one.
Confirmed threats trigger pre-approved containment playbooks, which isolate the affected endpoint, revoke compromised credentials and block the infrastructure involved. The actions that are pre-approved are agreed with you in advance, so that no business-critical system is disconnected without prior agreement. Every tier above Essentials includes bundled incident response hours, 20 on Advanced and 80 on Sovereign, so a confirmed breach is handled under the existing agreement.
Security events and audit logs are mapped to the UAE regulatory frameworks: NESA and the UAE Information Assurance Standards, DESC ISR, the UAE PDPL, SAMA CSF, NCA ECC, ISO 27001 and PCI DSS. Monthly reporting includes a compliance evidence pack. The evidence is assembled as events are generated, so it is available when an assessor asks for it.
Alert triage happens inside FortiSIEM before anything reaches you, and analysts validate what the correlation surfaces, so what you receive is a validated incident. Reporting is monthly on Advanced and Sovereign. Advanced adds quarterly threat hunting. Sovereign runs hunting monthly, with MITRE ATT&CK coverage reporting. The report states what was hunted and what was found.
SOC as a service means the platform, the analysts and the response process are provided on a subscription. The client receives a running capability without building one. The alternative is an in-house SOC, which requires the tooling plus enough analysts to cover three shifts, leave and attrition. The two options are usually compared on total cost and on how long each takes to reach useful coverage.
The answer depends on scale and on how much security work the organisation already carries. An in-house SOC needs enough analysts to staff three shifts, plus cover for leave and attrition, together with the platform, the detection content and staff to keep both current. A provider spreads that cost across clients. Some large regulated organisations run both: an internal team holding business context and escalation, with a provider covering nights and weekends.
In most cases, yes, depending on the telemetry they produce. The SOC runs on the Fortinet Security Fabric throughout. FortiSIEM correlates events natively from FortiEDR, FortiGate, FortiNDR, FortiMail and FortiDeceptor, which shortens onboarding and improves correlation. Third-party sources are ingested where they produce usable telemetry. During scoping, iConnect identifies which of your existing tools contribute to detection.
Talk to our team about your requirement
We’re happy to answer any questions you may have and help you determine which of our services best fit your needs.
Our Value Proposition
- Tailored Solutions for Your Organization
- Unbiased Expertise
- Proven IT Competence
- Outcome-Driven Approach
- Proactive Problem-Solving
- Transparent Processes
What happens next?
We’ll arrange a call at your convenience.
We do a discovery and consulting meeting
We’ll prepare a detailed proposal tailored to your requirements.