SOCHQ uses strictly-necessary session cookies for authentication and a same-site CSRF cookie. No third-party tracking or analytics cookies are set. See our Privacy Policy for details.
SOCHQThe SOC that
tells you
what it just did.
SOCHQ Pro+ is AI-native security operations. Every alert arrives pre-triaged, correlated to the campaign it belongs to, and narrated with citations to the exact MITRE technique and IOC source. Your analysts stop reading logs and start reading sentences.
A finance laptop, FIN-WS-08, started beaconing every 60 seconds to 89.248.165.74:443 — a server flagged by ThreatFox 11 hours ago as an active Cobalt Strike C2. JA3 matches a known operator profile, and two more hosts in the finance segment began the same beacon within 7 minutes. Almost certainly stage 5 of CMP-7741.
Nine capabilities. One codebase. Zero stitching.
SOCHQ replaces your "Splunk + 3 manual integrations + a Notion runbook" stack with one platform that comes with the playbook built in.
AI-native alert triage
Every alert auto-scored: statistical anomaly, per-tenant false-positive probability, UEBA baseline deviation, and a grounded LLM narrative. Analysts read sentences, not logs.
Cross-alert correlation
Six detection patterns running every 60 seconds: active campaigns, MITRE kill chains, impossible travel, lateral movement, hash reuse, anomaly pile-ups. Surfaces as a live banner.
SOCHQ Intel knowledge base
Versioned, tenant-scoped store: MITRE, CISA KEV, NVD, LOLBAS, Cloud IPs, Tor, plus your private runbooks and SOCHQ-authored intel. Every claim cites a real source.
Active Response (SOAR)
One-click block IP, disable account, isolate agent, kill process, quarantine file. Every action reversible from the same UI. Per-tenant audit log.
UEBA & risk scoring
Per-user baselines, peer-group outliers, drift detection, watchlists. The list of people worth a glance updates in real time as behaviour shifts.
MITRE ATT&CK heatmap
Live coverage map across all 14 tactics + 188 techniques. See which techniques have fired in your environment, color-coded by recency and frequency. Pivot from any cell to alerts.
Threat hunting + IOC mgmt
Custom queries, saved hunts, bulk IOC import / export. Match events surface as their own alert stream — see exactly when your IOCs hit.
Multi-tenant + impersonation
Built MSP-native: manage dozens of customers from one console, impersonate any tenant for support, RLS-enforced data isolation at four independent layers.
SOCHQ Agent provisioning
Customers self-serve agent install — Linux deb / rpm, Windows PowerShell, macOS. Group + enrollment token created at tenant signup. Zero-touch onboarding.
Every alert ends each sentence with a citation.
The AI cannot fabricate sources. Every [cite:N] marker in a narrative is validated server-side against the retrieval set. Click any pill, see the exact MITRE technique, KEV CVE, or SOCHQ Intel chunk it came from.
The citation contract.
Hallucination is structurally near-zero. Our prompts force the LLM to cite, our retrieval gives it sources, and our server rejects narratives whose citations don't validate. The model can refuse — it cannot invent.
Result: an AI you can sell to a regulated industry without flinching.
The knowledge base that compounds.
9 sources of truth, refreshed on their own schedules. Every customer who joins SOCHQ adds their private runbooks, and every resolved alert can be "tagged as a teachable case" — captured into the KB so future narratives cite it as precedent.
What a typical SOC makes you do. What SOCHQ does instead.
Most platforms hand you raw alerts and a bill that scales with your logs. SOCHQ hands you decisions — and the receipts behind them.
From one analyst to dozens of tenants.
Same platform, three distinct chromes. Each persona gets the surface they actually use, none of the surface they don't.
One person. The whole stack.
Replace your patchwork of free tools with a platform that comes with the playbook built in. Triage, hunt, respond — all from one console, narrated.
- ✓Full SOC analyst surface
- ✓One-click Active Response
- ✓Auto-response rules with confidence
- ✓Tag-as-teachable-case workflow
SMB security teams.
Multi-user workspace with role-based access, custom AR rules, API access for downstream tooling, and a higher LLM budget. Your team's tribal knowledge becomes the KB.
- ✓RBAC: analyst, manager, admin
- ✓Per-tenant KB segment
- ✓API for SIEM/SOAR downstream
- ✓Custom AR rule confidence scoring
Dozens of tenants. One console.
True multi-tenancy with four layers of data isolation. Manage every customer from one parent organisation, publish intel once and propagate to all child tenants, impersonate any tenant for support.
- ✓Cross-tenant alert visibility
- ✓MSP-published intel (auto-syndicate)
- ✓Per-customer billing + usage rollup
- ✓White-label support (Q4 2026)
Predictable pricing. No quote dance.
Every tier includes the SOCHQ Agent, the full AI pipeline, all 9 capabilities. The tier is about scale — agents, alerts/day, retention, MSP features — not features held hostage.
Solo IT
- 90-day data retention
- Everything in Family, plus:
- CrowdStrike + SIEM integrations
- Custom alert rules
- API access
- Full SOC analyst surface
Professional
- 90-day data retention
- Everything in Solo IT, plus:
- UEBA behavior analytics
- Vulnerability management
- Auto-response rules
- Compliance monitoring
MSP
- 180-day data retention
- Everything in Professional, plus:
- Multi-tenant management UI
- Bulk agent provisioning
- Quarterly business reviews
- Cross-tenant alert visibility
Enterprise
- Unlimited agents + tenants
- Unlimited data retention
- Dedicated SOCHQ VM
- SSO / SAML 2.0
- HIPAA / PCI DSS posture
- Custom integrations
- Named CSM + 24/7 priority
Pay once. Use Solo IT for life.
Ingest from everywhere you already collect.
SOCHQ doesn't replace your existing tools — it makes the alerts they're already producing finally actionable. Six built-in connectors, twenty more in the connector framework, plus webhook / syslog catch-alls.
Your next alert is going to tell you what it is.
The SOCHQ Agent ships on day one. By Friday your inbox will be alerts that read like sentences and end with citations.