---
title: "Security Operations Center for UniFi"
description: "CyberSecure IDS/IPS and DNS filtering on your UniFi gateways, read and acted on by the engineers who configured them. Bundled with TAC."
url: "https://unifiedit.tech/services/network-security"
lastmod: "2026-10-27"
type: "page"
---

![A monitoring desk at night lit in blue: three screens of scrolling log output and an empty chair](https://unifiedit.tech/images/services/network_security_hero.jpg)

[All Services](https://unifiedit.tech/services)

[ Support · Security Operations Center ]

# A SOC built on the gateway you already own

CyberSecure IDS/IPS and DNS filtering on your UniFi gateways, read and acted on by the engineers who configured them. Bundled with TAC, so there is no second vendor and no firewall subscription renewing at every site.

- Built for UniFi
- ·
- Bundled with TAC
- ·
- US-based engineers

[Talk to a Network Engineer](https://unifiedit.tech/schedule-call)

[ vs. a traditional SOC ]

## Five sites, a FortiGate at each, and a SOC provider billing about $5,000 a month to watch them.

That is a common setup, and it works. It also means two vendors, two contracts and a security subscription renewing at every site, to run signature detection your UniFi gateway already performs. What it buys you is a person watching the alerts. We think that person should also hold admin on the network.

A traditional SOC compared with the Unified IT SOC

|  | Traditional SOC | Unified IT SOC |
| --- | --- | --- |
| Sensor | A FortiGate at every site, plus a log collector shipping events out. | The UniFi gateway you already own, running CyberSecure IDS/IPS and DNS filtering. |
| Who reads the alert | Typically a tier-1 analyst reading logs from a network they have never seen. | A network engineer who configured the network and holds the as-built. |
| Response | An email to your IT contact asking them to act. | A change on the controller (client blocked, rule tightened), then a phone call. |
| Contract | A separate SOC agreement plus FortiGuard subscriptions at every site. | Bundled with TAC, on one agreement and one invoice. |
| Coverage | 24×7, priced accordingly. | Follows your TAC plan: 8×5 through 24×7. |
| Monthly cost | About $5,000 for five sites, before FortiGuard renewals. | [Talk to a Network Engineer](https://unifiedit.tech/schedule-call) |

[ How it works ]

## The gateway runs the signatures, and an engineer reads what fires

CyberSecure gives every UniFi gateway signature-based IDS/IPS, using Proofpoint ET Pro rules and Microsoft MAPP threat intelligence. CyberSecure Enterprise widens that ruleset. Neither one gives you someone who reads what fires, decides whether it matters on your network and acts on it. We add that person.

1. Telemetry
   
   ### Events the gateway already produces
   
   Nothing new is installed at your sites. We read what the UniFi gateway and controller emit today.
   
   - CyberSecure IDS/IPS alerts, per gateway
   - DNS filtering and content-control blocks
   - Firewall drops and policy hits
   - Client, VLAN and site context from the controller
2. Detect
   
   ### Read in the context of your network
   
   A signature hit means something different on a front-desk VLAN than on a camera VLAN. We know which is which.
   
   - Correlate signature to client to VLAN to site
   - Suppress noisy rules per site, never globally
   - Classify Sev 1 / 2 / 3 on the TAC scale
   - Escalate inside your plan’s SLA
3. Respond
   
   ### Containment is a config change
   
   The same engineers hold admin on the controller, so acting does not require a ticket to someone else.
   
   - Block the client at the gateway
   - Tighten the firewall rule or isolate the VLAN
   - Call your on-call contact by phone
   - Written incident report on close

[ What's included ]

## Included with TAC, on the same contract

The SOC ships inside Technical Assistance Center plans, on the same SLA. The only per-site cost is Ubiquiti's CyberSecure subscription on the gateway, which you would want regardless.

Included with TAC

- CyberSecure IDS/IPS alert review on every managed gateway
- DNS filtering and content-control event review
- Per-site signature tuning
- Severity classification and escalation on your TAC SLA
- Containment through the controller: client block, rule change or VLAN isolation
- Written incident report for every escalated event
- Monthly summary: alert volume, top signatures, actions taken
- CyberSecure ruleset and gateway firmware coordination

Coverage hours follow your TAC plan: 8×5 through 24×7.

[Compare TAC plans](https://unifiedit.tech/pricing#tac)

[ Sample incident report ]

## What closing an event looks like

Every escalated event ends with a written report: what fired, where, what we did, and what changed so it does not fire again. It goes to your IT contact the same day and into the quarterly review.

This is the shape of one. Names, addresses and times are illustrative.

INC-2026-0412 Sev 2 · Partial impact Closed

**Site**

Site 3 of 5 · Naples office

**Gateway**

UCG-Fiber · CyberSecure Enterprise

**Source**

10.30.14.57 · VLAN 30 Front desk · FD-WS02

**Destination**

198.51.100.23:443 · 4 connections in 6 min

**Signature**

ET MALWARE · outbound beacon to known command-and-control infrastructure

1. Detected 02:14
2. Acknowledged 02:19
3. Contained 02:31

Actions taken

1. 02:19 Alert reviewed. Beacon interval confirmed against the client's history in the controller.
2. 02:24 FD-WS02 blocked at the gateway.
3. 02:27 Firewall rule added: VLAN 30 to WAN, deny 198.51.100.0/24.
4. 02:31 Called on-call contact (J. Alvarez). Workstation pulled for reimage.

Follow-up

DNS filter: newly registered domains now blocked on VLAN 30. Signature left active with no suppression.

## Talk to a network engineer.

[Talk to an Engineer](https://unifiedit.tech/schedule-call)