RocketCyber scope of support

Overview

RocketCyber Product Support and the RocketCyber Security Operations Center (SOC) work together to assist partners using RocketCyber.

This article explains the responsibilities of Product Support and the SOC, when requests may be transferred between teams, and which types of issues are typically handled by each group.

The goal is to help partners understand how product-support requests and security-operations requests are managed and to help route requests to the appropriate team during platform-related issues or active security events.

Scope of Product Support

RocketCyber Product Support assists with product and platform-related issues. Contact Product Support for requests such as:

  • Platform functionality and operation

  • Product configuration questions

  • Integration setup and troubleshooting

  • Platform access issues

  • Onboarding-related product questions

  • General product usage questions

  • Technical product-support questions, including configuration, operational, and how-to questions

Product Support is the primary contact for general platform and product questions that are not related to an active security incident or managed security investigation.

Requests outside the scope of Product Support

Product Support does not perform security monitoring, alert triage, incident investigation, containment activities, or incident-response functions that fall within the responsibilities of the Security Operations Center (SOC).

Requests handled by the SOC include:

  • Active security incident investigations

  • Security alert triage and analysis

  • Investigation of suspicious or malicious activity identified by RocketCyber

  • Investigations involving unauthorized access or unauthorized use of privileges

  • Malware, ransomware, phishing, business email compromise, RDP abuse, suspicious PowerShell activity, DNS tunneling, denial-of-service (DoS) incidents, cryptojacking activity, man-in-the-middle (MITM) attacks, zero-day exploit activity, and similar security incidents identified through RocketCyber monitoring

  • Incident-response coordination

  • Supported containment and remediation actions, including host isolation and other supported response actions

These activities fall within SOC responsibilities and may require ticket transfer or collaboration between Product Support and the SOC.

Scope of SOC Support

The RocketCyber Security Operations Center (SOC) provides 24×7 monitoring, investigation, response, containment, and remediation support for active security incidents and managed security operations. The SOC works on behalf of partners to detect, investigate, contain, report, and recover from security incidents through the RocketCyber managed service.

SOC responsibilities include:

  • Monitoring security telemetry and alerts generated by the RocketCyber platform

  • Threat hunting, threat-intelligence analysis, and investigation of suspicious or malicious activity identified through RocketCyber monitoring

  • Analyzing events and escalating suspicious or malicious activity to incidents

  • Investigating active security events and incidents

  • Security alert triage, investigation, and escalation

  • Incident communication and coordination

  • Alert lifecycle management and investigation documentation

  • Investigation findings and remediation guidance provided through SOC-generated tickets and alert workflows

  • Validation of suspected threats

  • Execution of supported containment and remediation actions, including host isolation and other supported response activities

  • Coordination with partner contacts during active incidents

  • Providing investigation results, incident updates, and notification activities in accordance with RocketCyber workflows and configured notification settings

The SOC is the appropriate contact when the request requires security investigation, incident response, or direct discussion with a SOC analyst about an alert or incident from the RocketCyber platform.

Partner and SOC responsibilities

RocketCyber's managed security service is based on a partnership between the SOC and the partner. The SOC works on the partner's behalf to detect, investigate, contain, report, and help remediate security incidents identified through RocketCyber monitoring.

The SOC is responsible for monitoring security events, triaging alerts, investigating suspicious activity, escalating incidents, and performing supported response and containment actions within the managed service scope.

Partners remain responsible for maintaining and administering their environments, including implementing and maintaining appropriate security controls, making business and remediation decisions, and performing actions that occur outside the RocketCyber platform.

RocketCyber recommends that partners maintain security best practices, including:

  • Deploying and maintaining endpoint protection

  • Implementing appropriate firewall policies

  • Enabling multi-factor authentication (MFA)

  • Maintaining backups and business continuity processes

  • Following least-privilege access principles

  • Keeping systems updated and patched

  • Providing user security-awareness training

The effectiveness of the managed service depends on cooperation between the SOC and the partner. While the SOC provides monitoring, investigation, escalation, and response activities, partners remain responsible for implementing and maintaining the security controls necessary to protect their environments.

Ticket routing and escalation

Product Support and the SOC work together to ensure requests are handled by the appropriate team.

Requests involving security monitoring, alert investigations, incident response, threat containment, or remediation activities may be routed to the SOC.

Requests involving platform functionality, configuration, integrations, access, deployment, or general platform operation may be routed to Product Support.

If a request contains both product-support and security-investigation elements, the teams may collaborate to ensure the request is handled appropriately.

Need to contact Product Support or the SOC?

This article explains which team is responsible for different types of requests. For contact information, operating hours, phone numbers, and ticket submission instructions, see Contacting the RocketCyber Security Operations Center (SOC).