SOC as a Service

Our SOC runs on Sumo Logic SIEM and SentinelOne EDR plus Mjolnir’s proprietary SOAR engine — our preferred platforms, and the stack MSOC is built on. We also integrate with any SIEM or EDR you already run. You get custom detection logic, threat intelligence from MÍMIR, and automated response — not a generic monitoring feed.

Analysts are tiered specialists — endpoint, network, cloud, identity — not generalists on a ticket queue. Every case runs through MSOC, our purpose-built SOC orchestration platform with full SLA tracking and client reporting.

Proactive threat hunting is included. Hypothesis-driven, informed by MÍMIR intelligence — discovers dormant implants, living-off-the-land activity, and supply chain compromises before they escalate.

The Platform Stack

Sumo Logic for log ingestion and correlation. Mjolnir’s detection engineers write custom queries and tune thresholds per client — not shared rulesets. Proprietary tools extend coverage across the full investigation lifecycle:

• SEIÐR — our Sumo Logic integration layer that normalizes, enriches, and routes alerts from Sumo Logic into the VÁR investigation pipeline
• YGGDRASIL — proprietary case management and ticketing system built for SOC workflows with SLA tracking and client-facing reporting
• MÍMIR — threat intelligence platform that enriches every alert with IOC data, MITRE ATT&CK mapping, and adversary profiling
• GJALLARHORN — M365 log extraction and analysis tool for email, SharePoint, and Teams forensics
• SIF — remote evidence collection agent for rapid endpoint forensics without disrupting operations
• HILDR — canary token deployment and monitoring for early-warning deception across your environment

24/7/365 Monitoring & Detection

Our SOC operates continuously with no gaps in coverage. Analysts work in structured shifts with overlapping handoff procedures to ensure continuity. Every alert is triaged within minutes, investigated by a human analyst, and either resolved or escalated with full context — no automated closures, no dismissed alerts. Our mean time to detect (MTTD) is under 5 minutes, and our mean time to respond (MTTR) is under 30 minutes for critical severity events.

Works With Any SIEM. Prefers Two.

We integrate with any SIEM your organization already runs. Our preferred platforms are Sumo Logic (SIEM) and SentinelOne (EDR) — the stack MSOC is built on. 56 data sources configured across cloud, network, identity, endpoint, email, container, and OT/ICS environments. See all 56 data sources →

Compliance Reporting

Every SOCaaS engagement includes compliance-ready reporting tailored to your regulatory framework. We produce monthly operational reports, quarterly executive summaries, and on-demand audit evidence packages aligned with SOC 2, PCI DSS, HIPAA, NIST CSF, and ISO 27001 requirements. Your compliance team receives structured, auditor-friendly documentation without lifting a finger.

Core SOCaaS Capabilities

• 24/7/365 human-led monitoring, detection, and response
• Mean time to detect (MTTD) under 5 minutes
• Mean time to respond (MTTR) under 30 minutes for critical events
• Sumo Logic SIEM management, tuning, and custom detection rule development
• Proprietary SOAR playbook design, deployment, and continuous optimization
• EDR management with real-time endpoint isolation capabilities
• Proactive threat hunting with monthly campaign reports
• Cloud workload monitoring (AWS, Azure, GCP)
• Identity and access anomaly detection
• Email security monitoring and phishing response
• Monthly compliance reporting (SOC 2, PCI, HIPAA, NIST, ISO 27001)
• Dedicated account manager and quarterly business reviews

Canadian Data Residency

Mjolnir Security is 100% Canadian-owned and operated. All SOCaaS data is processed and stored in Canadian data centers, ensuring compliance with PIPEDA, Quebec's Law 25, provincial privacy legislation, and federal data sovereignty requirements. For organizations subject to Bill C-26 (Critical Cyber Systems Protection Act) or those requiring Canadian data residency for cyber insurance compliance, our SOC infrastructure meets the highest standards of data sovereignty.

Regulatory Alignment

• Bill C-26 (Critical Cyber Systems Protection Act) — continuous monitoring and reporting capabilities aligned with critical infrastructure requirements
• Quebec Law 25 — privacy incident notification and data handling compliance
• Cyber insurance — SOCaaS documentation and evidence packages designed for insurance carrier audit requirements
• PIPEDA — Canadian data residency with full privacy breach notification support