ClearSkies iISOC for MSSPs

Integrate Everything.Automate the Rest.

Stop losing margins to custom API builds and manual onboarding. Deploy new tenants instantly, connect their existing tools natively, and automate your managed response workflows.

Request a Demo

Architecture

Three layers, and what each contributes

LayerWhat sits thereWhat it contributes
Below the engineiCollector, the six native add-ons, Marketplace connectors and open ingestionTelemetry normalized into the shared context-aware model at collection, so no translation step is needed later
The engineCentric-AI Fabric, Detection Factory, the TDIR engine, risk scoring, alert routing, the agentic layer, SOAR and playbooksEntity resolution, correlation into incidents, one explainable score, and governed action back through connected controls
Above the engineOperator console, per-tenant client portals, ChatOps, service catalog, reporting and cost-to-serve analyticsWhat you operate from and what each client sees under your brand

Core functions

On every tenant, at its assigned tier

Independent of which add-ons are licensed.

  • Detect and decide

    • Detection Factory authors content with ATT&CK technique identifiers carried as metadata
    • Risk scoring formula puts an identity event and an endpoint event on one comparable scale
    • Intelligent alert routing sends each detection to automation, an analyst tier or the client tier
    • Generative and agentic AI builds the narrative and drives autonomous investigation
    • UEBA baselines normal behavior per user, host and identity
    • Threat hunting promotes hypothesis-led findings into detection content

  • Respond, evidence and extend

    • SOAR orchestrates response across native add-ons and third-party controls
    • Playbooks encode the sequences, selectable on technique and configurable per tenant
    • Threat intelligence fuses commercial, open-source and ISAC feeds, curated per client sector
    • KPIs and SLAs measure per tenant and surface breach risk in advance
    • Regulatory frameworks map detection and evidence to what each client reports under
    • ClearSkies Marketplace connects third-party products, enabled per tenant

Each core function is documented in its own brief.

See core functionalities

Interoperability

Open at the edges, one model in the middle

  • Native connectors

    The six add-ons and the Marketplace across endpoint, network, identity, cloud and email.

  • Open ingestion

    Syslog, CEF, LEEF, REST API, agents and OpenTelemetry.

  • Structured intelligence

    STIX and TAXII, in and out.

  • Detection exchange

    Sigma, so content moves with you rather than being stranded.

  • Schema alignment

    Normalized events align to OCSF conventions.

On portability the position is stated commercially rather than technically: what may be exported, in what format, over what period and at what cost.

Displacement and assurance

Changing the correlation core, not the client's infrastructure

  • Migration and coexistence

    ContentDetection migrated through Sigma where portable, rewritten where it is not
    HistoryRetained in place for the rest of its retention period or exported, so the evidence chain holds
    ParityA parallel run establishes detection parity before the incumbent retires, measured rather than asserted
    ScopeThe platform ingests from tools the client already owns

  • Frameworks and assurance

    DetectionMITRE ATT&CK, with MITRE Engenuity evaluations for independent validation
    ReportingNIST Cybersecurity Framework 2.0 outcome language for board reporting
    ControlsISO/IEC 27001 and 27002 mapping and audit evidence
    SubprocessorSOC 2 Type II or ISAE 3402, which you pass to your own clients
    EuropeNIS2, DORA and GDPR reporting, resilience and privacy obligations
    AIEU AI Act governance of the generative and agentic layer

See it working, then check the numbers

Request a Demo