SIEM and security operations (SOC)

Spot it, stop it, work out what happened

Say an employee's account starts downloading the customer database at 3 a.m. Three kinds of tool deal with it, one after another.

Box 1 spots the download among millions of records. Box 2 runs the response automatically. Box 3 works out afterwards what the attacker did. Tap a title in the diagram to jump to its companies.

SIEM: one record of every alert 3 companies

A SIEM (security information and event management) collects the logs and alerts from every product into one searchable record. It also learns how each user and machine normally behaves, and flags what does not fit.

SecuronixSecuronix sells a SIEM that combines the record, the behaviour checks and the automated response. It has engineers in Bengaluru and Pune. Since 2025 it has also owned ThreatQuotient, which collects information about known attackers.Bengaluru · PuneHiring now

GuruculGurucul, with engineers in Pune, started with checks on how users behave, and later built a SIEM around them.Pune

VehereVehere, in Kolkata, records the traffic inside a network, which gives the SIEM the network half of the evidence.KolkataSee alsoNetwork security, firewalls and SASE

The tech, explainedSIEM Network detection and response (NDR)↗ Enterprise cybersecurityThreat intelligence platform

Automating the response 4 companies

A playbook is the list of steps the team takes for each kind of alert: look up where the download is going, cut the laptop off the network, disable the account, open a ticket and tell the right people. Done by hand, this takes an hour; run automatically, it takes seconds. This is called SOAR.

SwimlaneSwimlane sells Turbine, a general tool for automating the security team's work. It has engineers in Hyderabad.

CywareCyware, from New York with engineers in Bengaluru, combines three products: information about known attackers, automated playbooks, and a way to share that information between companies.

FlexibleIRFlexibleIR started in Bengaluru and is now based in Singapore. It sells playbooks and a shared space where a team handles an attack, and runs practice drills of an attack.

AiStrikeAiStrike, which builds its product in Pune, uses AI models to do the first sorting of alerts, deciding which ones matter, a job that analysts used to do.

The tech, explainedSOAR AI SOC analyst Incident response and tabletop exercises

Investigating after an attack 2 companies

After an attack, investigators collect data from phones, computers and cloud accounts, and work out what the attacker did. This is called digital forensics.

Oxygen ForensicsOxygen Forensics makes tools that extract and analyse data from phones, computers, cloud accounts and backups. It has engineers in Hyderabad.

ThreatLensThreatLens, a small New York company with engineers in Bengaluru, sells a tool for investigating alerts, together with a control over how staff use AI tools.

The tech, explainedDigital forensics

How it all worksSecurity operations centre (SOC)Every alert lands here, around the clock.

See how it works →

What's changing

AI now does the first look at each alert.

A security team receives far more alerts than its analysts can read. AI models now do the first look at each alert: they collect the related records, decide whether it matters, and write a summary, so analysts spend their time on the few that are real.