HexaPrime
Trusted by Enterprises Across UAE & GCC•ISO 27001 Certified•CREST Certified•24/7 Security Operations
Contact Us
Cyber SOC

Managed CyberSOC Service for the Dubai Cyber Index

CyberSOC is a scored service of the Dubai Cyber Index. HexaPrime operates your side of it — sustaining the availability of the 12 mandated data sources and resolving DESC CyberSOC alerts in under 3 minutes against a 5-minute DCI SLA, to maintain a CyberSOC score of 5.

Dubai Cyber Index • DCI score • DESC CyberSOC • Managed DCI provider • DESC alert response • DESC log sources • Dubai Government cybersecurity • Managed SOC UAE
Dubai Cyber Index • DCI score • DESC CyberSOC • Managed DCI provider • DESC alert response • DESC log sources • Dubai Government cybersecurity • Managed SOC UAE
About
Cyber SOC

How HexaPrime help you with Cyber SOC!

Under the Dubai Cyber Index (DCI), DESC assesses Dubai Government entities across defined services — CyberSOC being one of them. DESC's CyberSOC ingests and analyses logs from the entity's mandated data sources, correlates them and issues alerts back to the entity. The entity's DCI CyberSOC score is driven by how well it sustains those feeds and how promptly and completely it acts on the alerts raised. As a Managed DCI provider, HexaPrime takes operational ownership of that responsibility: monitoring log source health so the 12 data sources stay connected and reporting, triaging and actioning every DESC CyberSOC alert within the agreed response and closure SLAs, and producing the evidence DESC expects. Scoring and compliance determinations remain with DESC and the entity; HexaPrime delivers and evidences the operational performance behind the score.

Key
Features
  • Data source availability management — continuous health monitoring of the 12 mandated DESC data sources; detect log-flow interruption, parsing failure or agent loss and restore the feed
  • Onboarding and integration of data sources — connect in-scope sources to the DESC CyberSOC platform to the required format and standard
  • DESC alert triage and validation — acknowledge DESC CyberSOC alerts in under 1 minute (MTTA), then validate, enrich and establish scope and impact
  • Alert response and resolution — take the appropriate action and resolve the alert in under 3 minutes (MTTR), within the 5-minute DCI SLA
  • SLA governance — measure MTTA and MTTR against the 5-minute DCI SLA on every alert; escalate immediately where a breach is at risk
  • DCI score management — sustain the response performance that holds the CyberSOC score at 5, with corrective action where metrics drift
  • Evidence and reporting — alert registers with timestamps, MTTA/MTTR performance, source uptime and DCI score reporting for the entity and DESC
  • Coordination with DESC — act as the entity's operational interface to the DESC CyberSOC for alerts, feeds and clarifications
Let’s Connect
Tell us how we can help secure and strengthen your organization.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Workflow
How the managed DCI CyberSOC service operates
<style>.sd.is-dashed .sd_loop:before{border-left-style:dashed;border-right-style:dashed;border-bottom-style:dashed}.sd.is-dashed .sd_lg.is-l:before{border-left-style:dashed;border-top-style:dashed}.sd.is-dashed .sd_lg.is-r:before{border-right-style:dashed;border-top-style:dashed}.sd_card.is-left .sd_b.is-red li:before{background:#E62E2D}.sd_card.is-left>.sd_ico{align-self:center}@container (max-width:900px){.sd_card.is-left>.sd_ico{align-self:flex-start}}@container (min-width:1001px){.sd .sd_cyc.is-lbl{border:0;overflow-x:clip;margin-left:calc((100% - 5 * 1.566cqw) / 6 * var(--lf))!important;margin-right:calc((100% - 5 * 1.566cqw) / 6 * var(--lf))!important}.sd_cyc.is-lbl:before{content:"";position:absolute;inset:0;border:2px dashed #E62E2D;border-top:0;border-bottom:0}.sd_cyc.is-lbl .sd_pill{background:#100C0D;border:0;border-radius:6px;padding:.3em .7em;font-size:clamp(13px,1.4cqw,24px);font-weight:700;color:#fff;letter-spacing:0}.sd_cyc.is-lbl .sd_pill:before,.sd_cyc.is-lbl .sd_pill:after{content:"";position:absolute;top:50%;width:100vw;height:0;margin-top:-1px;border-top:2px dashed #E62E2D}.sd_cyc.is-lbl .sd_pill:before{right:calc(100% + var(--g) - .7em)}.sd_cyc.is-lbl .sd_pill:after{left:calc(100% + var(--g) - .7em)}.sd_ah{position:absolute;top:50%;width:clamp(8px,.75cqw,13px);height:clamp(8px,.75cqw,13px);margin-top:calc(clamp(8px,.75cqw,13px) / -2);border:solid #E62E2D;border-width:2px 2px 0 0}.sd_ah.is-l{right:calc(100% + var(--g) - .7em - 2px);transform:rotate(45deg)}.sd_ah.is-r{left:calc(100% + var(--g) - .7em - 2px);transform:rotate(-135deg)}.sd .sd_row.is-arrows .sd_step:not(:last-child):after{display:block;content:"";position:absolute;top:50%;right:calc(-1.566cqw + 2px);width:9px;height:9px;margin-top:-5.5px;border:solid #E62E2D;border-width:2px 2px 0 0;transform:rotate(45deg);z-index:4;animation:none;background:none}}@container (max-width:1000px){.sd_ah{display:none}}.sd .sd_row .sd_num{width:clamp(26px,3.1cqw,50px);height:clamp(26px,3.1cqw,50px);font-size:clamp(12px,1.45cqw,22px);top:calc(clamp(26px,3.1cqw,50px) / -2);left:clamp(10px,1.3cqw,24px);transform:none}.sd .sd_row .sd_num{top:clamp(10px,1.3cqw,22px)}.sd .sd_row .sd_card{padding-top:calc(clamp(26px,3.1cqw,50px) + clamp(18px,2cqw,34px))}</style><div class="sd is-dashed" style="--n:6"><div class="sd_row is-arrows"><div class="sd_step"><div class="sd_card is-left"><img class="sd_ico" style="object-fit:contain" src="https://cdn.prod.website-files.com/6a8df6c4166ed6e5454a4f94/6aa93d9403cff95c86db0cdc_hxp-cybersoc-01-onboard.png" alt="" loading="lazy"><h3 class="sd_t">Onboard</h3><p class="sd_d">Connect required sources and define service targets</p><ul class="sd_b is-red" style="margin-top:.4cqw"><li>Data sources</li><li>SLAs</li><li>Authority</li></ul></div></div><div class="sd_step"><div class="sd_card is-left"><img class="sd_ico" style="object-fit:contain" src="https://cdn.prod.website-files.com/6a8df6c4166ed6e5454a4f94/6aa93d94c68c5c3f3c0e4c78_hxp-cybersoc-02-sustain.png" alt="" loading="lazy"><h3 class="sd_t">Sustain</h3><p class="sd_d">Maintain continuous data source availability</p><ul class="sd_b is-red" style="margin-top:.4cqw"><li>Feed health</li><li>Monitoring</li><li>Recovery</li></ul></div></div><div class="sd_step"><div class="sd_card is-left"><img class="sd_ico" style="object-fit:contain" src="https://cdn.prod.website-files.com/6a8df6c4166ed6e5454a4f94/6aa93d94c68c5c3f3c0e4c9c_hxp-cybersoc-03-receive.png" alt="" loading="lazy"><h3 class="sd_t">Receive</h3><p class="sd_d">Receive and acknowledge SOC alerts quickly</p><ul class="sd_b is-red" style="margin-top:.4cqw"><li>Fast acknowledgement</li></ul></div></div><div class="sd_step"><div class="sd_card is-left"><img class="sd_ico" style="object-fit:contain" src="https://cdn.prod.website-files.com/6a8df6c4166ed6e5454a4f94/6aa93d94c68c5c3f3c0e4cbd_hxp-cybersoc-04-action.png" alt="" loading="lazy"><h3 class="sd_t">Action</h3><p class="sd_d">Triage, investigate and coordinate response</p><ul class="sd_b is-red" style="margin-top:.4cqw"><li>Validation</li><li>Containment</li><li>Remediation</li></ul></div></div><div class="sd_step"><div class="sd_card is-left"><img class="sd_ico" style="object-fit:contain" src="https://cdn.prod.website-files.com/6a8df6c4166ed6e5454a4f94/6aa93d94df20e37fe36fab57_hxp-cybersoc-05-resolve.png" alt="" loading="lazy"><h3 class="sd_t">Resolve</h3><p class="sd_d">Close incidents within SLA with evidence</p><ul class="sd_b is-red" style="margin-top:.4cqw"><li>Resolution time</li><li>Documentation</li></ul></div></div><div class="sd_step"><div class="sd_card is-left"><img class="sd_ico" style="object-fit:contain" src="https://cdn.prod.website-files.com/6a8df6c4166ed6e5454a4f94/6aa93d94c68c5c3f3c0e4cd9_hxp-cybersoc-06-report.png" alt="" loading="lazy"><h3 class="sd_t">Report &amp; Improve</h3><p class="sd_d">Track performance and improve service quality</p><ul class="sd_b is-red" style="margin-top:.4cqw"><li>MTTA</li><li>MTTR</li><li>DCI Score</li><li>Reviews</li></ul></div></div></div><div class="sd_cyc is-dash is-lbl" data-span="1-6" data-centres style="--lf:.395;--g:6cqw"><span class="sd_pill"><i class="sd_ah is-l"></i>Continuous Service Improvement<i class="sd_ah is-r"></i></span></div></div>
Service Deliverables
Everything the service delivers. Built around measurable outcomes.
01
Source Availability & Alert Resolution
  • Data source availability monitoring and restoration for the 12 mandated DESC sources
  • Acknowledgement, action and resolution of DESC CyberSOC alerts at MTTA < 1 min and MTTR < 3 min
02
Alert Register & SLA Reporting
  • Alert register with receipt, acknowledgement and resolution timestamps, actions taken and justifications
  • MTTA / MTTR performance reporting against the 5-minute DCI SLA, including breaches and root cause
03
Uptime & Score Tracking
  • Data source uptime and log-flow continuity reporting
  • DCI CyberSOC score tracking against the target of 5, with corrective action plan
04
Authority & Evidence
  • Agreed response-authority matrix
  • Evidence pack supporting DESC / DCI assessment
05
Service Reviews
  • Periodic service reviews with the entity

See what Cyber SOC delivers and how it fits your environment.

Talk to a Cyber SOC Expert
FAQs
Frequently Asked Questions
What is the Dubai Cyber Index and how does CyberSOC affect our score?

The Dubai Cyber Index (DCI) is DESC's assessment of cyber maturity across Dubai Government entities. CyberSOC is one of the scored services within it. The CyberSOC score turns on response speed — alerts must be resolved within 5 minutes to hold a score of 5 — alongside consistent log delivery from your mandated data sources.

What are the 12 data sources?

DESC mandates a defined set of log sources that must be onboarded to the CyberSOC for analysis. During onboarding we confirm the current list against your environment, close any gaps and put continuous availability monitoring around each feed.

Does HexaPrime replace the DESC CyberSOC?

No. DESC operates the CyberSOC and issues the alerts. HexaPrime operates the entity side of the service — keeping your data sources available, actioning the alerts DESC raises, and maintaining the evidence and SLA performance that support your DCI score.

What happens if a data source stops sending logs?

Our monitoring flags the interruption, we investigate the cause — agent, connectivity, licensing, parsing or platform change — and restore the feed, then log the gap and its remediation as evidence. Restoring feeds quickly is what prevents availability from eroding your DCI CyberSOC score.

What are the alert response SLAs?

The DCI SLA for a DESC CyberSOC alert is 5 minutes to resolution — meeting it is what holds the CyberSOC score at 5. As a Managed DCI provider HexaPrime operates well inside it: mean time to acknowledge (MTTA) under 1 minute and mean time to resolve (MTTR) under 3 minutes, leaving deliberate headroom against the 5-minute threshold. Performance is measured and reported on every alert.

Do you guarantee our DCI score?

We commit to the operational performance that drives it — MTTA under 1 minute, MTTR under 3 minutes against the 5-minute DCI SLA, source availability and evidence quality — which is what sustains a CyberSOC score of 5. The score itself is determined by DESC, and some inputs sit outside the CyberSOC service.

Ready to Secure Your Business?

Protect your organization with enterprise-grade cybersecurity, cloud, and managed IT solutions tailored to your business needs.

Schedule a ConsultationTalk to Our Experts