Alerts & Security Operations (SOC/NOC)

Last updated:

What it is

Chorum takes in alerts from your monitoring and security tools, tidies them up, works out which customer service each one affects, and can turn them into tickets. Security alerts get a dedicated operations view with an AI assessment and one click response actions, so your SOC and NOC work happens inside Chorum.

The alert pipeline

  1. An alert is collected from an integration. Security and EDR tools are polled every few minutes; sources that support it, such as some network devices, push in real time by webhook.
  2. Chorum normalises it into a common shape, then de-duplicates it using a signature and flap detection, so a storm of repeats collapses into one alert rather than hundreds.
  3. It is resolved to a customer service, so you immediately know who and what is affected.
  4. It is stored in the alert queue, and can be converted into a ticket for tracking and SLA.

The security operations view

A security alert opens a SOC view that lays out the MITRE kill chain and the affected asset. For SentinelOne it also shows the indicators of compromise and the full process lineage. An AI triage assessment summarises the threat and a recommended verdict. Provider neutral response actions, such as isolate the device, reconnect it, quarantine a file (SentinelOne), or run a scan, are available directly from the ticket, and each action is recorded on the ticket timeline for audit.

Supported sources

Security and monitoring integrations feed the pipeline, including SentinelOne, Microsoft Defender, BitDefender, CrowdStrike, Microsoft Intune and Microsoft Entra, so endpoint, identity and network signals all land in the same queue.