Agentic SOC for companies on Microsoft 365
Security monitoring (SOC) with artificial intelligence
A SOC, or security operations center, reviews what happens in your systems and acts when something is wrong. In ours, artificial intelligence agents review your logs continuously, basic issues are contained with rules you approve and a person on our team decides on anything critical.
Free 30-minute consultation: we talk about what you need to monitor. We reply during business hours.
Pralogy, a cybersecurity firm headquartered in Miami, with an office in Bogotá, Colombia, runs an agentic SOC: artificial intelligence agents continuously review Microsoft 365, Entra ID and Azure logs, and basic issues are contained with rules you approve. A person on our team decides anything critical. You get alerts with the analysis and a monthly report. Pralogy has been in business since 2019.
Do any of these situations sound familiar?
Anyone looking for a SOC is almost always looking for the same thing: someone to review what happens in their systems and respond if something is wrong.
“Our tools generate alerts and no one can keep up with them.”
“A client or an auditor asks us who monitors our security.”
“Someone got into a company email account and we found out days later.”
“Our staff report suspicious emails and no one knows what to do with them.”
“We want someone to monitor our systems day and night.”
“We had an incident and do not want to be caught off guard again.”
That is what the agentic SOC is for: artificial intelligence reviews your logs continuously, and our team decides on critical issues during business hours.
How it works
We collect your logs
From Microsoft 365, Entra ID and Azure, plus the emails your staff report.
Artificial intelligence reviews them
Continuously: it prioritizes what matters and drafts the analysis. It does not take any action.
Basic issues are contained automatically
With rules you approve, such as signing users out or blocking compromised accounts. A person decides anything critical.
You receive the analysis
The alert with what we recommend doing and, every month, a report on what happened.
What it monitors
Access that should not happen
Sign-ins with the correct password from countries where your company does not operate, and authentication methods registered by someone else.
Email fraud
Inbox rules that hide or forward emails, forwarding to outside addresses and mass sending from a company account.
Risky permissions
Apps granted access to email or files, new administrators and changes to security settings.
Your files
Mass downloads or deletions in OneDrive and SharePoint, and public links that suddenly appear.
Your Azure cloud
Management ports open to the internet and changes to storage access.
Emails your staff report
Every reported email is classified; a person on our team decides the doubtful ones.
If something happens, our specialists support you
During an incident
We guide containment with your team, investigate with chain of custody and deliver the report with the verified facts and the action plan.
During a crisis
We help you decide what to communicate and to whom, and how to answer what your client, your auditor or your insurer asks.
A real case: an action plan the same day
A software company in a managed security program received a security alert from a third party. It was answered the same day, with an action plan. These times are from this case, not a response-time commitment.
More than a console
Looking for someone to handle all of your security, beyond monitoring? That is the managed security program: a yearly plan with testing, compliance and response, and a report every month.
If you need something else
- Incident responseIf you have an incident in progress, email [email protected] and mark it as urgent to ask about our availability.
- Secure infrastructureIf you prefer to run your own SIEM, we implement it with Wazuh alongside your team.
- All servicesSecurity testing, ISO 27001 and security awareness training.
Frequently asked questions
What is an agentic SOC?
It is a security operations center (SOC) where artificial intelligence agents review the logs continuously, and people on our team decide on critical issues and support the response. The artificial intelligence prioritizes and drafts; automatic actions only follow rules you approve.
Which systems does the agentic SOC cover?
Microsoft 365 (email and files), Entra ID and Azure, plus the emails your staff report. In the free 30-minute consultation, we go over what your company uses and what we can cover.
Does the artificial intelligence make decisions on its own?
It prioritizes, summarizes and proposes. Automatic actions, such as signing users out or blocking a compromised account, only happen under rules you approve in advance; a person on our team decides everything else.
What happens if the SOC blocks someone by mistake?
The account stays blocked until a person on our team reviews it, and both you and the user are notified. To avoid that, we start with two weeks in which the system only records what it would have done; it never blocks anyone for failed sign-in attempts, and administrator accounts always go through a person.
Do you monitor us day and night?
The automated review never stops and, with the rules you approve, basic containment works at any hour. Our analysts work during business hours. For managed security program clients, the contract includes a response within 8 business hours at most and 24/7 forensic response.
How quickly does the agentic SOC detect an issue?
It depends on the log: Microsoft delivers some of them with a delay. That is why response times are agreed in the contract.
Do we need additional Microsoft licenses for the SOC?
It works with what Microsoft 365 business plans include. With Entra ID P1, you see more detail about sign-ins.
What happens to our data in the SOC?
The logs contain personal data. We process them on your behalf, under a contract and only to monitor your security, and we delete them when the contract ends.
Do I need a SOC or the managed security program?
If your company has no security team and you want someone to handle all of it, choose the managed security program: a plan, testing, compliance and response. If you need to monitor your Microsoft accounts and cloud, choose the agentic SOC. You can combine them. In the free 30-minute consultation, we suggest where to start.
A client or an auditor asks who monitors our security. What do we tell them?
With the agentic SOC, you have the answer in writing: what is monitored, how we respond and the monthly report. The managed security program goes further: if a client, an auditor, your insurer or a regulator asks about your security, we answer and stand by you.
How much does security monitoring (SOC) cost?
It depends on the number of users and the scope. In the free 30-minute consultation, we talk about what you need to monitor, and then we send you a written proposal.
Tell us what you need to monitor
Include what your company uses (Microsoft 365, Azure or other tools), what concerns you and who is asking you to have monitoring in place. It is a conversation with our engineering team to understand your situation and suggest where to start.
What happens next: we reply during business hours to set a time. If you want to continue, we define the scope and send you a written proposal. If it is outside what we do, we will tell you.