07Service line
Managed security, IT, cloud and application support services
Onion Infosec operates security tooling, IT infrastructure, cloud platforms and applications on your behalf under a service agreement. Coverage hours, severity tiers, escalation paths and reporting cadence are defined during onboarding, with 24×7 options for security monitoring, incident response readiness and support.
- Line
- 07 of 07 · Managed Services & Support
- Shape
- Secure → Run → Support → Maintain → Respond
- Delivery
- Project, retainer or managed service
01Context
What managed services covers
Managed Services & Support is the operating side of Onion Infosec. It runs what other teams, ours or yours, have built: security monitoring and response, servers and networks, cloud platforms, the service desk and application support. Recurring maintenance such as patching and backup monitoring belongs to the same service.
Each service is defined by a model and recorded in a service agreement: what is covered, during which hours, how incidents are classified, who is contacted and how performance is reported. Services can be fully managed or co-managed with your own team.
- Around-the-clock coverage is hard to staff
- Monitoring and support outside business hours need shift rotations, trained analysts and tested escalation. A managed service provides that coverage without an internal rota.
- Operations decide whether controls last
- A hardened system drifts unless someone patches it, reviews its alerts and checks its backups. Giving that recurring work to an accountable team keeps project results in place.
- One operating model across security, IT and cloud
- When monitoring, infrastructure and cloud sit with different providers, incidents stall at the boundaries. One set of runbooks and one escalation path give an alert a direct route to the engineer who can fix the cause.
Architecture
Operations as a loop.
A queue closes tickets. A loop removes their cause. The same seven steps run across everything we operate.
A continuous loop of seven steps applied to security, IT, cloud and applications. 1, Monitor: Security telemetry, infrastructure health and application availability, watched 24×7. 2, Detect: Detections and thresholds tuned to the environment raise events. 3, Triage: Events are confirmed, prioritized and routed: threats to analysts, faults to engineers, requests to the service desk. 4, Respond: Containment for security incidents and restoration for outages, along agreed escalation paths. 5, Resolve: The cause is fixed: a patch, a configuration change or a code fix, under change control. 6, Report: Service reporting on incidents, changes, coverage and open risk. 7, Improve: Recurring issues become automation, new detections or engineering work. Improve leads back to monitor.
Security telemetry, infrastructure health and application availability, watched 24×7.
Detections and thresholds tuned to the environment raise events.
Events are confirmed, prioritized and routed: threats to analysts, faults to engineers, requests to the service desk.
Containment for security incidents and restoration for outages, along agreed escalation paths.
The cause is fixed: a patch, a configuration change or a code fix, under change control.
Service reporting on incidents, changes, coverage and open risk.
Recurring issues become automation, new detections or engineering work.
02Approach
How the service model works
Service levels are described by model and agreed per engagement. Coverage hours, severity definitions, escalation contacts and reporting cadence are written into the service agreement during onboarding. We do not publish generic response times, because meaningful targets depend on scope and coverage.
Work is ticketed and changes follow your change process. Access to your environment is least-privilege, logged and reviewed.
01
Coverage hours
Each service states when it is staffed: business hours, extended hours or 24×7. Security monitoring, incident response readiness and support are available 24×7.
02
Severity tiers
Incidents and requests are classified by impact and urgency, using definitions agreed with you. The tier determines who is engaged and how the issue is communicated.
03
Escalation paths
Every tier has a named path on both sides, from analyst or engineer to service lead to your decision makers. The out-of-hours contact list is tested.
04
Reporting cadence
Regular operational reports and periodic service reviews cover ticket volumes, incidents, performance against the agreed service levels and changes to the roadmap.
03Capabilities
How managed services work is organized.
Secure
Security tooling and monitoring, run around the clock.
Run
IT and cloud estates operated under agreement.
Support
People and applications kept working.
Maintain
Patching, backups and routine care.
Respond
Help when something goes wrong.
Managed Security
Security monitoring and response operated on the platforms you own, fully managed or co-managed. Monitoring runs 24×7.
- 24×7 security monitoringContinuous monitoring, triage and escalation of alerts from SIEM, endpoint, identity and cloud sources. Escalations include evidence and a recommended action.
- Managed SOCTiered analysts work to documented runbooks. Detection content, use cases and the escalation matrix are maintained for your environment.
- Managed detection and response (MDR)Investigation and containment on endpoint, identity and cloud telemetry. Containment actions such as host isolation and account disablement are pre-approved in the runbook.
- Managed SIEM and EDRPlatform administration, log-source onboarding, rule tuning and health checks for the SIEM and endpoint tooling.
- Managed vulnerability scanningScheduled scanning, triage by exploitability, owner assignment and verified closure.
- Threat hunting and detection updatesScheduled hunts and regular releases of detection content, reported with findings and telemetry gaps.
Managed IT
Day-to-day operation of servers, networks, endpoints, directories and Microsoft 365 to documented standards.
- Infrastructure operationsMonitoring, administration and lifecycle tasks for servers, virtualization and storage.
- Network operationsAdministration of switches, firewalls, VPN and Wi-Fi under change control, with configuration backups.
- Endpoint operationsDevice provisioning, upkeep of compliance policies and software deployment for laptops and mobile devices.
- Directory and Microsoft 365 administrationUser, group, license and mailbox administration, including joiner, mover and leaver requests.
- Vendor coordinationLiaison with internet, hardware and software suppliers during faults and renewals, so that your team has one point of contact.
Managed Cloud
Ongoing operation of AWS, Azure and Google Cloud environments, with infrastructure held as code and changes made by pull request.
- Cloud operationsProvisioning, scaling, patching and governance of cloud accounts, subscriptions and workloads.
- Infrastructure as code maintenanceUpkeep of Terraform or Bicep modules, state and pipelines. Drift is detected and corrected.
- Cloud monitoring and observabilityMetrics, logs and alerting for platform and workload health, tied to the service objectives agreed with you.
- Cloud posture managementReview and remediation of posture findings, upkeep of guardrail policies and IAM entitlement reviews.
- Cost managementRegular spend reviews with right-sizing, scheduling and reservation recommendations.
- Kubernetes and container platform operationsCluster upgrades, node and image patching, and policy upkeep for AKS, EKS and GKE.
Service Desk & Remote Support
A single point of contact for users and IT staff. Tickets are logged, classified by severity tier and resolved or escalated along agreed paths. Support is available 24×7.
- Service deskUser support by phone, email and portal, with ticket logging, classification and tracking to closure.
- Remote supportRemote troubleshooting of devices, applications and access problems using audited remote tools.
- Security-aware request handlingIdentity is verified before password and MFA resets. Reported phishing is routed to the monitoring team.
- On-site supportScheduled or dispatched visits for hardware faults, office moves and tasks that cannot be done remotely.
- Knowledge base and user guidanceDocumented fixes and how-to articles maintained from ticket history to cut repeat requests.
Application Support
Support for business and custom applications after go-live, including those built by Onion development teams.
- Application monitoringAvailability, error-rate and performance monitoring, with alerts routed by severity tier.
- Tiered application supportIssue triage, log analysis and workarounds at the first tiers. Code-level defects pass to development with the evidence attached.
- Release and deployment supportScheduled releases through the pipeline with pre-release checks, rollback steps and post-release verification.
- Database administrationBackup checks, patching, performance review and access management for application databases.
- Dependency and security patchingLibrary, runtime and base-image updates driven by SCA findings and vendor advisories.
Maintenance
Recurring maintenance with a schedule, a coverage measure and a report for each activity.
- Patch managementRisk-ranked patching of operating systems, firmware and third-party software in agreed windows, with coverage and exception reporting.
- Backup monitoringDaily review of backup jobs, rerun of failures and scheduled restore tests with recorded results.
- Health checksPeriodic reviews of capacity, certificates, licenses, end-of-life software and configuration drift.
- Hardening upkeepBaselines are re-applied after changes and checked against CIS Benchmarks.
Incident Support
Handling of operational and security incidents, from first report to post-incident review. Incident response readiness is available 24×7.
- Major incident managementCoordination of outages and high-severity faults with a named incident lead, a communication schedule and a recorded timeline.
- Security incident escalationSuspected intrusions are handed from monitoring to incident responders along a pre-agreed path, with evidence preserved.
- Incident response retainerEngagement terms are agreed and the environment is onboarded in advance, so that responders can start without contract work.
- Post-incident reviewRoot cause analysis and a list of corrective actions, tracked to completion in service reviews.
- Problem managementAnalysis of recurring incidents to find and remove the underlying cause.
04Process
How a managed services engagement runs.
Discovery and scoping
We review the environment, current tooling and documentation, then agree the service scope, coverage hours and responsibilities.
Onboarding
Access is set up with least privilege, and monitoring and log sources are connected. Runbooks, the escalation matrix and severity definitions are written and agreed.
Transition
Responsibility moves in stages, often with a parallel-run period alongside the previous team, until the handover checklist is complete.
Steady-state operation
Monitoring, tickets, changes and maintenance run to the runbooks. Escalations follow the agreed paths.
Reporting and review
Operational reports and periodic service reviews cover performance against the agreed service levels, incidents, risks and planned changes.
Continual improvement
Incidents, false positives and recurring tickets drive tuning, automation and updates to the runbooks.
What you receive
- Service agreement with scope, coverage hours, severity definitions and service levels
- Responsibility matrix for managed and co-managed areas
- Runbooks and an escalation matrix specific to your environment
- Onboarding and transition plan with a handover checklist
- Regular operational reports on tickets, incidents, patch coverage and backup status
- Periodic service review with risks, trends and roadmap changes
- Post-incident reviews with corrective actions
05Technical depth
Typical managed services engagements, technology and methods.
Fully managed service
Onion operates the defined scope end to end under a service agreement, usually on an annual term with regular service reviews.
Co-managed service
Responsibilities are split with your team in a written matrix. Common splits are by platform, by support tier or by time of day.
After-hours and overflow cover
Your team works business hours and Onion covers nights, weekends and peaks, using the same runbooks and ticket system.
Transition from a project
A system built or secured by an Onion project team moves into operations through a defined handover, with runbooks and an early-life support period.
Transition from another provider
Structured takeover with discovery, documentation, access transfer and a parallel-run period before full responsibility moves.
Technology areas
Security operations
IT and endpoint management
Cloud operations
Service management
Monitoring and backup
Technologies are named to describe the work. Naming a product does not indicate a commercial partnership.
Frameworks and methods
ITIL practices
Structure for incident, request, change and problem management.
ISO/IEC 20000-1
Reference for how services are planned, delivered and reviewed.
MITRE ATT&CK
Maps detection coverage and structures hunts in managed security.
NIST SP 800-61
Reference for incident handling phases and the handover from monitoring to response.
CIS Controls and Benchmarks
Baselines for patching, hardening and configuration checks.
SRE practices
Service level objectives and blameless post-incident reviews for cloud and application operations.
06Across lines
How build and secure teams hand over to operations.
Systems built by Onion cloud, development and IT teams enter operations through a defined handover. Architecture documents, infrastructure as code, runbooks, monitoring and known risks are transferred and checked against a list. Security teams hand detection content, open findings and response playbooks to security operations. Operations reports recurring issues back to those teams, so that fixes are made at the source.
07Questions
Managed Services & Support: questions we are asked
No. Service levels are agreed per engagement and recorded in the service agreement, because they depend on scope, coverage hours and the severity model. Performance against them is reported on the agreed cadence.
Security monitoring, incident response readiness and support are offered 24×7. Other services run during business or extended hours, as stated in the service agreement.
Yes. A written responsibility matrix sets out who handles which platforms, tiers and hours. Both teams work from the same runbooks and ticket history.
No. We operate the SIEM, endpoint, cloud and ITSM platforms you already own, and recommend a change only when a tool cannot meet the requirement. Runbooks, detection content and documentation produced for you remain yours.
Access is least-privilege, tied to named individuals, protected by MFA and logged. Telemetry stays in your tenant wherever the platform allows. Access is reviewed during service reviews and removed at offboarding.