Antivirus, EDR or SOC: what sees an attack at night?

Q: Do we need a SOC if we have EDR?

EDR produces the alert and can isolate the PC. The SOC reads it at any hour, sets aside the false positive and calls the named contact. Without a reader, the console waits until Monday.

Q: Who is called at night?

The SOC analyst, then the contact named in the contract. Cover between Christmas and New Year is detailed on 16 December.

Antivirus blocks a file already known on the PC. EDR sees abnormal behaviour and can isolate the machine. The SOC is someone who reads the alert at 3 a.m. and calls. The three do not replace one another. An SMB that has only antivirus discovers the incident when a file will no longer open.

Host Technology attaches its 24/7 SOC to the customer's EDR and to the SIEM/SOAR. Teams are in France. Outside the EDR scope, the contract provides one response day with the CERT. Without EDR there is no signal to qualify. This text says what each piece sees. Who is on duty between Christmas and New Year is another article, on 16 December.

Antivirus

Antivirus compares a file with signatures and a few heuristics. It stops an attachment already listed. It does not tell you that a legitimate account is encrypting shares at 2 a.m., or that a Windows admin tool is being used in a way that does not look like Monday's work. On an SMB estate it remains useful. It is not detection.

A PC with no up-to-date antivirus is a hole. An estate that stops there has nobody to isolate that PC if the file is unknown. ANSSI's IT hygiene guide asks for protection against malicious code and a way to trace what happened.

EDR

EDR records what the PC or the server does: a process started, a file encrypted in bulk, an unusual outbound connection. It can cut the machine off the network before the whole share is unreadable. It produces an alert. An alert with no reader stays a line in a console nobody opens at the weekend.

Host deploys EDR on the PCs and servers in the agreed scope. The tool does not choose whom to call. It does not administer the firewall and it does not restore a backup. It gives a dated signal you can show.

The SOC

The SOC qualifies that signal, at any hour. The analyst sets aside the false positive or escalates to the contact named in the contract. The monthly report says what was qualified and what waits for an action: an account to revoke, a PC to rebuild, a rule to close. Host does not sell a screen. It sells that reading, attached to the customer's EDR.

The SOC does not replace managed IT. Managed IT holds the PCs, the patches and the site visit. The SOC does not replace the firewall or the immutable copy. If the incident is not seen by EDR, the CERT response day in the contract takes over. The detail is on the SOC page, not in a general promise.

What an SMB can hold

Up-to-date antivirus on every PC, as a baseline, not as detection.
EDR on the PCs and servers that matter, with a console someone opens.
A name and a number called at night, tested, not a mailbox closed at the weekend.
A SOC on the day nobody internal still reads alerts outside office hours.
Alongside: firewall, named admin accounts, a tested backup. Detection restores nothing.

A clinic, a hotel or an SMB head office asks the same question at 3 a.m.: who sees the alert. The consequences are not the same. Continuity of care is covered on 1 November. Holiday cover is covered on 16 December. Here we separate the tools.

Sources

ANSSI IT hygiene guide, protection against malicious code, logging and monitoring: https://cyber.gouv.fr/publications/guide-dhygiene-informatique. The split between antivirus, EDR and the 24/7 SOC is Host Technology's contract: the customer's EDR, SIEM/SOAR, teams in France, a CERT day outside the EDR scope.

FAQ

Is antivirus enough against ransomware?

It blocks known files. Encryption started by a legitimate account or an admin tool often gets past it. EDR is there to see that behaviour and isolate the PC.

Do we need a SOC if we have EDR?

EDR produces the alert and can isolate the PC. The SOC is the person who reads that alert at any hour, sets aside the false positive and calls the named contact. With no reader, the console waits until Monday morning.

Does the SOC replace managed IT?

No. Managed IT holds the PCs, the updates and the on-site visit. The SOC qualifies security alerts. The two contracts complement each other. They do not replace one another.

Can we take the SOC without EDR?

No. The first job is to deploy EDR. Detection does not attach to an empty console.

Who is called at night?

The SOC analyst, then the contact named in the contract. That path is tested before you need it. Cover between Christmas and New Year is detailed on 16 December.