ThreatKrusher 24/7 SOC Operations Charter
Governing Standard: NIST SP 800-61 Rev 2 / CMMC IR.2.093 - IR.2.097
1. Mission and Mandate
The ThreatKrusher Security Operations Center (SOC) delivers continuous, 24/7/365 threat detection, behavioral telemetry analysis, human-in-the-loop incident triage, and automated threat containment across eTrepid managed environments and client infrastructure.
2. Operational Architecture & Telemetry Ingestion
flowchart LR
E["Client Managed Endpoints & Cloud Enclaves"] -->|Encrypted Telemetry| ING["ThreatKrusher Telemetry Ingestion Engine"]
ING -->|Automated Correlation| COR["Real-Time Threat Analytics & SIEM"]
COR -->|High-Confidence Threat| AUTO["Automated Isolation Playbook"]
COR -->|Suspicious Activity| HUM["Tier 2/3 Human Analyst Triage"]
HUM --> AUTO
HUM --> NOT["Client Escalation & Defense Briefing"]
2.1 Staffing and US Citizenship Requirements
The ThreatKrusher SOC is staffed 24/7/365 by qualified cybersecurity analysts and engineers based exclusively within the United States, meeting the citizenship and screening mandates required for defense contractor support.
2.2 Incident Severity Triage & Response SLAs
| Severity Tier | Definition | Initial Response SLA | Containment SLA |
|---|---|---|---|
| Critical (P1) | Active ransomware, confirmed unauthorized data exfiltration, or root domain controller compromise. | < 15 minutes | Immediate automated isolation + Tier 3 engagement. |
| High (P2) | Suspicious privilege escalation, credential dumping, or uncontained malware on non-critical endpoint. | < 30 minutes | < 1 hour. |
| Medium (P3) | Known malware blocked by EDR, policy violations, or anomalous off-hours sign-in. | < 2 hours | < 4 hours. |
| Low (P4) | Informational alerts, routine vulnerability notifications, or standard configuration drift. | < 24 hours | Next scheduled maintenance window. |
3. Containment Capabilities
ThreatKrusher SOC operators possess authorized capabilities to execute: