Skip to main content
A monitoring desk at night lit in blue: three screens of scrolling log output and an empty chair
All Services

[ Support · Security Operations Center ]

A SOC built on the gateway you already own

CyberSecure IDS/IPS and DNS filtering on your UniFi gateways, read and acted on by the engineers who configured them. Bundled with TAC, so there is no second vendor and no firewall subscription renewing at every site.

  • Built for UniFi
  • Bundled with TAC
  • US-based engineers
Talk to a Network Engineer

[ vs. a traditional SOC ]

Five sites, a FortiGate at each, and a SOC provider billing about $5,000 a month to watch them.

That is a common setup, and it works. It also means two vendors, two contracts and a security subscription renewing at every site, to run signature detection your UniFi gateway already performs. What it buys you is a person watching the alerts. We think that person should also hold admin on the network.

A traditional SOC compared with the Unified IT SOC
Traditional SOCUnified IT SOC
SensorA FortiGate at every site, plus a log collector shipping events out.The UniFi gateway you already own, running CyberSecure IDS/IPS and DNS filtering.
Who reads the alertTypically a tier-1 analyst reading logs from a network they have never seen.A network engineer who configured the network and holds the as-built.
ResponseAn email to your IT contact asking them to act.A change on the controller (client blocked, rule tightened), then a phone call.
ContractA separate SOC agreement plus FortiGuard subscriptions at every site.Bundled with TAC, on one agreement and one invoice.
Coverage24×7, priced accordingly.Follows your TAC plan: 8×5 through 24×7.
Monthly costAbout $5,000 for five sites, before FortiGuard renewals.Talk to a Network Engineer

[ How it works ]

The gateway runs the signatures, and an engineer reads what fires

CyberSecure gives every UniFi gateway signature-based IDS/IPS, using Proofpoint ET Pro rules and Microsoft MAPP threat intelligence. CyberSecure Enterprise widens that ruleset. Neither one gives you someone who reads what fires, decides whether it matters on your network and acts on it. We add that person.

  1. Telemetry

    Events the gateway already produces

    Nothing new is installed at your sites. We read what the UniFi gateway and controller emit today.

    • CyberSecure IDS/IPS alerts, per gateway
    • DNS filtering and content-control blocks
    • Firewall drops and policy hits
    • Client, VLAN and site context from the controller
  2. Detect

    Read in the context of your network

    A signature hit means something different on a front-desk VLAN than on a camera VLAN. We know which is which.

    • Correlate signature to client to VLAN to site
    • Suppress noisy rules per site, never globally
    • Classify Sev 1 / 2 / 3 on the TAC scale
    • Escalate inside your plan’s SLA
  3. Respond

    Containment is a config change

    The same engineers hold admin on the controller, so acting does not require a ticket to someone else.

    • Block the client at the gateway
    • Tighten the firewall rule or isolate the VLAN
    • Call your on-call contact by phone
    • Written incident report on close

[ What's included ]

Included with TAC, on the same contract

The SOC ships inside Technical Assistance Center plans, on the same SLA. The only per-site cost is Ubiquiti's CyberSecure subscription on the gateway, which you would want regardless.

Included with TAC
  • CyberSecure IDS/IPS alert review on every managed gateway
  • DNS filtering and content-control event review
  • Per-site signature tuning
  • Severity classification and escalation on your TAC SLA
  • Containment through the controller: client block, rule change or VLAN isolation
  • Written incident report for every escalated event
  • Monthly summary: alert volume, top signatures, actions taken
  • CyberSecure ruleset and gateway firmware coordination

Coverage hours follow your TAC plan: 8×5 through 24×7.

Compare TAC plans

[ Sample incident report ]

What closing an event looks like

Every escalated event ends with a written report: what fired, where, what we did, and what changed so it does not fire again. It goes to your IT contact the same day and into the quarterly review.

This is the shape of one. Names, addresses and times are illustrative.

INC-2026-0412Sev 2 · Partial impactClosed
Site
Site 3 of 5 · Naples office
Gateway
UCG-Fiber · CyberSecure Enterprise
Source
10.30.14.57 · VLAN 30 Front desk · FD-WS02
Destination
198.51.100.23:443 · 4 connections in 6 min
Signature
ET MALWARE · outbound beacon to known command-and-control infrastructure
  1. Detected
  2. Acknowledged
  3. Contained
Actions taken
  1. Alert reviewed. Beacon interval confirmed against the client's history in the controller.
  2. FD-WS02 blocked at the gateway.
  3. Firewall rule added: VLAN 30 to WAN, deny 198.51.100.0/24.
  4. Called on-call contact (J. Alvarez). Workstation pulled for reimage.
Follow-up

DNS filter: newly registered domains now blocked on VLAN 30. Signature left active with no suppression.

Talk to a network engineer.

Talk to an Engineer