COMGUARD Security Operation Services (SOS) is a managed security operations service designed for organizations that lack the internal resources to manage their own security processes. The service covers the definition and management of security use cases, threat hunting, policy creation, and threshold definition for security events. It includes the specification of required data sources such as logs and access credentials for scanners. SOS handles regular operational tasks including: - Event collection for defined use cases - Monitoring and alerting on SIEM log source and agent availability - Definition and management of vulnerability scan configurations and scan target availability - IPS threshold definition and tuning based on environmental changes - Identity source availability monitoring (user accounts across systems, including non-AD sources) - Creation and adjustment of investigation rules, correlation rules, and reports for SIEM and vulnerability management (VM) - Anomaly detection and false positive assessment with recommendations for SIEM, VM, and IPS - Analysis of security events and critical vulnerabilities, including exception handling - Evaluation of remediation effectiveness (patch application, policy changes) across VM, IPS, and SIEM - Service quality tuning to defined levels - On-call availability - Dashboard and report design, including integration with internal ticketing systems - Security incident investigation on demand The service was developed as part of an EU-funded innovation project under the "Business and Innovation for Competitiveness" (OP PIK) operational programme.