TotalHealManaged SOCManaged Security Operations
TotalHeal analysts watch your alerts, investigate them with the full timeline and contain threats under the response targets in your contract — inside your own TotalHeal console, where you can see every step.
Why organisations ask for it
Detection tools raise alerts at all hours. Most organisations cannot staff a round-the-clock security team, so alerts wait until morning and a ransomware operator gets a night to work. Managed SOC puts trained analysts on your alerts without you building that team.
Every alert looked at
Alerts land in a shared SOC queue; an analyst acknowledges, investigates and closes or escalates each one.
Containment, not just a ticket
Within the actions your response policy allows, we kill a process, quarantine a file, block an address or isolate a Linux server, and lock a laptop — then tell you what we did.
Clocks you can audit
Acknowledge, notify, contain and resolve timers run per incident in the console, with CERT-In (6 hours) and DPDP reporting clocks.
Nothing hidden
We work in your console under a consented provider link. Every action is in your hash-chained audit trail.
What our team does
Monitor and triage
- Watch the SOC queue for your organisation during the coverage hours you choose
- Acknowledge each alert and set its severity
- Close false positives with a written reason and tune the rule that raised them
Investigate
- Rebuild the attack on the incident timeline across endpoints, identities and logs
- Hunt for the same indicators across your estate with HuntSphere
- Map activity to MITRE ATT&CK techniques in the incident
Respond
- Linux servers (ThreatTrace): kill a process, quarantine a file, block an address in the host firewall or isolate the server
- Laptops and desktops: quarantine malware with ThreatGuard, lock a device with DeviceSphere, move it to a quarantine network with NetworkGate
- Act at once, with approval or by recommendation, as your response policy says; destructive actions always need a second human approver
- Run your ResponseFlow playbooks where you have them
Hand over and report
- Shift handovers recorded in the console, so nothing is lost between analysts
- Notify your contacts by severity, by e-mail and phone
- Prepare the facts for CERT-In and DPDP reports within their clocks
The response clock
Every incident runs four timers in your console, from the moment the alert arrives.
Your price — order and pay
Prices in Indian rupees, GST extra. Paid in advance: pay online, ask for a payment link, or take a proforma for your purchase order. Onboarding starts within one working day of payment.
- Everything in Business hours
- 24×7 analysts
- Threat hunting every month
- Quarterly posture review with your leadership
A larger or custom scope? Size it for a quote
Several sites, special coverage hours or extra add-ons: enter your estate and choices, see the scope and the TotalHeal licences it needs, and send it to us — we reply with a quote.
What you receive
Incident notification
What happened, what we did, what you need to do, with a link to the incident in your console.
Service report
Alerts handled, incidents by severity, time to acknowledge and contain against your targets, rules tuned.
Service review
Trends, recurring causes and the changes we recommend to policies and coverage.
Regulator-ready facts
Timeline, affected systems and actions taken, prepared for your CERT-In or DPDP filing.
Runs on TotalHeal products
The service works in your own TotalHeal console, on products that are available today.
How an engagement runs
Order and pay — or ask for a quote
Choose the plan and size on this page and pay in advance (online, a payment link or a proforma for your purchase order); for a custom scope, size it below and we send a quote. Either way you get the written service terms: coverage hours, response targets and runbooks.
Give consent
Your administrator accepts TotalHeal’s provider link in your own console. Until then we have no access. Every action we take is recorded in your audit trail and ours, and you can end the link at any time.
Onboard
We enrol agents, connect your sources, agree the escalation contacts and the actions we may take without asking, and tune the policies to your environment.
Run
The service runs in your TotalHeal console, so you see exactly what our analysts see and do, as it happens.
Report and review
Scheduled reports by e-mail and PDF, and a regular review with your team of what happened, what was done and what to change.
What we need from you
- An administrator to accept the provider link
- Escalation contacts for each severity, reachable during your coverage hours
- A list of actions we may take without asking
- Notice of planned changes that could look like an attack