Security operations with real analysts — not alerts you babysit
Managed security operations over the SIEM, EDR, identity and email tools you already run. Practitioners investigate and escalate the ambiguous and high-impact cases, with evidence and a next step.
Console preview at soc.ragnarok.com. Or book thirty minutes — how Heimdall would run on your stack.
Noisegetscleared.Apersonownseverydecisionthatmatters—andyougettheevidenceeitherway.
How Heimdall runs
Four steps, owned end to end. Your team hears from us when it matters — not every time a sensor blinks.
What’s covered
One managed service — orchestration over your stack, not a replacement SIEM.
- Security operations24/7 monitoring and triage with escalations to people who know your environment.
- Detection & responseCorrelated cases; analysts take the call when confidence is low or impact is high.
- Cross-layer correlationIdentity, cloud and endpoint activity stitched into one incident instead of five tickets.
- CloudAWS, Azure and GCP configuration and activity in scope for your engagement, with remediation guidance attached.
- IdentityPrivilege changes, MFA gaps and stale service accounts across the identity sources in your scope.
- Compliance evidenceControls mapped to SOC 2, ISO 27001 and PCI DSS, with exports auditors can follow.
What an escalation looks like
When we call, you get this — what happened, the evidence, the impact, and the one thing to do next.
Heimdall escalation · example format
HighOAuth consent granted to an unverified app from a new location
- What happened
A finance user signed in from an unfamiliar network and granted mailbox read/write access to a newly registered application. Two inbox forwarding rules were created minutes later.
- Evidence
- Sign-in from a network not seen for this user in 90 days
- Consent to an app registered the same day, with Mail.ReadWrite scope
- Forwarding rules sending invoices to an external address
- Impact
Likely business-email compromise in progress. Invoice and payment threads are exposed.
- Next step
Revoke the app consent and the user’s sessions, remove the rules, and reset credentials. We can action this now under your approved runbook.
Illustrative format. Real escalations are specific to your environment and never published.
SOCaaS
FromCA$29/ user / month
Per monitored user. Volume and coverage confirmed on the review.
Questions teams ask first
The tools you already run — commonly SIEM, EDR, identity and email security platforms. Exact sources are confirmed on the coverage review. Heimdall orchestrates; your upstream tools stay the system of record.
A named contact on our team. You hear from us when a case needs your decision or action, with evidence and a recommended next step. Routine volume is handled without paging your team.
Only under runbooks you approve in advance — for example revoking sessions or isolating a host via your EDR. Every action is logged and reversible.
CA$29 per monitored user per month. The coverage review sets the user count and confirms which sources are in scope.
The console is at soc.ragnarok.com. New customers get access after onboarding; book a coverage review if you want to see how it would run on your stack first. You can also preview the console UI before signing.
Sources in scope are agreed first, then baselined, then escalation paths are confirmed. You get the plan and timeline in writing before you sign.
See how Heimdall would run on your stack
Book a coverage review, or preview the console at soc.ragnarok.com.