Tenant: --
● Connected
Agents: 0 online
🚨 Recent High-Severity Alerts
📋 Open Tickets & Incidents

Loading...


🔗 Integration Status Checking...

Loading integration status...

Live Status

LIVE
--
⚡ Live Event Feed
0 crit 0 high 0 med 0 low
Time Level Description Agent MITRE
Loading live events...
Events/min: -- Last event: -- Top agent: -- ES status: -- Auto-refresh: 30s
Updating...
Threat Activity
Critical
High
Medium
Low
Detected Threat Events 0 events
Timestamp Source Source IP Target Target IP Severity Rule Agent

Device Monitoring

LIVE
Sysmon, PowerShell & Defender Events

Loading device events...

Network Monitoring

LIVE
Suricata, Zeek & Sysmon Network Events

Loading network events...

File Integrity Monitoring

LIVE
File Change Events

Loading FIM events...

Endpoint Status

LIVE
Registered Endpoints
AgentIPOSLast EventStatus

Service Availability

ES Nodes
Indices
Index Health Status Docs Size Shards
▼ Latest first
TimestampAgentDescriptionLevelMITREDetails

Critical Alerts

Timestamp Agent Rule Level MITRE
📄

Alert History

Historical alert data with filtering, time range selection, and export capabilities.

Threat Hunting

Quick Hunts by MITRE ATT&CK
Hunt Results

Open the Quick Hunts library above to run a preset, enter IoCs or a query, then click Hunt.
Built-in presets: External IPs, PowerShell, Suspicious Processes, Brute Force, Log Clearing, Data Exfil, Lateral Movement, Recon

Threat Intelligence

Sources: Loading...
All New Triage Investigation Containment Eradication Recovery Closed

Resolved Incidents

📋

Asset Inventory

Complete asset register with ownership, classification, and risk assessment.

🖥

Managed Devices

All devices under management with configuration status and compliance data.

All Windows Linux
Server Name IP Address Operating System Agent Version Status Alerts Last Seen
Loading servers...

Cloud Resources

Multi-cloud asset management including AWS, Azure, and GCP resources.

Security Reports

Generate professional reports for executive summaries, compliance audits, and technical deep dives. All reports are tenant-aware and pull live data from your connected Elasticsearch backends.

Orel Technology Solutions Inc. — CONFIDENTIAL
📈 Executive Summary
📋 Compliance Reports
🔍 Technical Deep Dive

📈 Executive Summary Report

Select a period and click Generate Report to create an executive summary with live data from the platform.

📋 Compliance Report

Select a compliance framework and period to generate a compliance posture report based on your SOC controls and evidence.

🔍 Technical Deep Dive Report

Select a focus area and time range for a detailed technical analysis with raw data, trends, and forensic-level detail.

📈

Operational Metrics

SOC performance metrics: MTTR, detection rates, ticket volume, and analyst productivity.

Export Reports

Generate detailed reports from live SOC data, export in multiple formats, and send directly via email to stakeholders. All reports include live metrics from your connected Elasticsearch backends.

Orel Technology Solutions Inc. — CONFIDENTIAL
Select Report Type
📈 Executive Summary High-level overview with key metrics and top alerts
🔒 Vulnerability Report CVE details, severity distribution, affected agents
🌐 Threat Intelligence IOC summary, feed status, threat landscape
🚨 Incident Report Open incidents, response status, case summaries

📦

Export Report Generator

Select a report type, configure the time period and format, then click Generate Report to build your export. You can download the report or send it via email.

✉ Send via Email
Requires SMTP configured in Integrations. The report HTML is sent as the email body.

OrelMSOC Platform User Guide

A comprehensive walkthrough of the Managed Security Operations Center platform — from navigation to incident response workflows.

v2.1 — June 2026

1. Platform Overview

OrelMSOC is a unified Security Operations platform that integrates Wazuh SIEM, Threat Intelligence, and a built-in Ticketing System under a single dashboard. It provides SOC analysts with real-time visibility into security events, endpoints, vulnerabilities, and incident response workflows.

Real-timeAlert Monitoring
UnifiedSIEM Integration
Built-inTicketing & Cases
Multi-TenantClient Management
Tip: OrelMSOC supports multiple clients/tenants. Each client connects to its own Elasticsearch backend. Switch between clients using the Tenants dropdown in the left sidebar (labeled "Tenants").

2. Getting Started

Logging In

1Open your browser and navigate to the OrelMSOC platform URL.
2Enter your Username and Password provided by your administrator.
3Click Sign In to access the dashboard.

Selecting a Tenant

1In the left sidebar, locate the Tenants dropdown.
2Click the dropdown and select the client/tenant you want to monitor.
3The entire dashboard reloads with data from that tenant's Elasticsearch backend.
Tip: Your last active tenant is saved and will be auto-selected on your next login. Only tenants you have permission to access will appear in the list.

3. Navigation Guide

The left sidebar organizes the platform into logical sections. Click any item to navigate.

SectionPagesDescription
HomeOverview, Live Status, Analyst DashboardHigh-level metrics, real-time system status, and threat map
MonitoringDevice Monitoring, Network Monitoring, Endpoint Status, Service AvailabilityDetailed monitoring of endpoints, network health, and service uptime
AlertsActive Alerts, Critical Alerts, Alert HistoryWazuh security alerts with filtering, escalation, and ticketing
ThreatThreat Hunting, Threat IntelligenceProactive threat searches and IOC lookups
IncidentsOpen Incidents, Investigations, Case Timeline, Resolved IncidentsFull incident lifecycle management
AssetsAsset Inventory, Managed Devices, Servers, Cloud ResourcesAsset tracking and inventory management
AnalyticsSecurity Reports, Operational Metrics, Trends, Export ReportsReporting and analytical tools
Knowledge CenterUser Guide, SOPs, FAQs, Release NotesDocumentation and reference materials
AdministrationClients, User Management, Roles, Incident Mgmt, Integrations, Audit Logs, System SettingsPlatform configuration and management

📊4. Dashboard & Monitoring

Overview Page — Your landing page after login. Displays:

  • Stat Cards — Total alerts, critical alerts, active endpoints, open incidents — all updated in real-time.
  • Recent Alerts — Latest security events from the selected tenant.
  • Alert Status Distribution — Visual breakdown of alert severities.

Live Status — Real-time system health with auto-refresh. Shows:

  • Elasticsearch connection status
  • Agent connectivity counts
  • Recent alert stream
  • Service availability indicators

Analyst Dashboard — Interactive threat map displaying global alert sources with geolocation.

Tip: Use the profile dropdown (top-right) to access system settings and manage your session. The platform auto-logs out after a period of inactivity.

🚨5. Alert Management

Alerts are ingested from Wazuh via Elasticsearch. The platform organizes them by severity and status.

Working with Alerts:

1Navigate to Alerts > Active Alerts to view all incoming security events.
2Use the severity filter tabs (All, Critical, High, Medium, Low) to narrow results.
3Click an alert to expand its details, including rule description, MITRE ATT&CK mapping, and event data.
4Click Create Ticket to generate an incident ticket from any alert. The ticket inherits alert metadata automatically.
5Use the Escalate button on critical alerts to trigger escalation workflows with SLA tracking.
Tip: The Critical Alerts page shows only alerts with level 12+ (or your configured threshold). These require immediate attention.

📄6. Incident & Ticket Management

The ticketing system transforms alerts into actionable incidents with full lifecycle management.

Ticket Lifecycle:

  • New — Freshly created from an alert or manually entered.
  • In Progress — Being worked on by an assigned analyst.
  • Resolved — Mitigated and awaiting verification.
  • Closed — Finalized with closure notes.

Managing Tickets:

1Go to Incidents > Open Incidents to view all active tickets.
2Click a ticket to view full details, MITRE mapping, and alert correlation.
3Use Assign to designate an analyst, and Change Status to update the stage.
4Add Notes to document investigation steps and findings.
5The system tracks SLA deadlines and escalation timers based on severity.

Investigations — Group related tickets into cases for coordinated response. Navigate to Incidents > Investigations to manage.

🛡7. Threat Management

Threat Hunting — Proactively search for Indicators of Compromise (IOCs) across your environment.

  • Search by IP address, domain, hash, or URL.
  • Results are enriched with Threat Intelligence data.
  • Create tickets directly from hunt findings.

Threat Intelligence — Centralized IOC database with reputation scoring from multiple integrated feeds.

  • View all known IOCs with reputation status (Malicious, Suspicious, Safe, Unknown).
  • Manually add IOCs or let the platform auto-populate from alerts.
  • Each IOC includes source attribution, reputation score, and last-checked timestamp.
  • IOC enrichment is powered by 8 integration modules — configure which feeds to use under Administration > Integrations.

Available Threat Intelligence Feeds:

  • AlienVault OTX — Community-driven threat intelligence with pulse indicators.
  • VirusTotal — Multi-engine file/URL/hash threat detection and reputation.
  • AbuseIPDB — IP address blacklist and reputation scoring.
  • Shodan — Device fingerprinting and exposed service intelligence.
  • Blocklist.de — Crowdsourced IP blocklist for malicious hosts.
  • AdGuard DNS — Domain-based threat filtering and reputation checks.
Tip: Use Threat Hunting before confirming an incident to gather evidence. All hunt results can be converted into tickets with one click. Enable multiple TI feeds in Integrations for broader IOC coverage.

8. Client & Tenant Administration

Each client/tenant connects to its own Elasticsearch instance. Administrators can manage them under Administration > Clients.

Adding a Client:

1Go to Administration > Clients and click Add Client.
2Enter a Client Name, ES URL (e.g., https://your-es-host:9200), and credentials.
3Set the alert index prefix (default: orelmsoc-alerts) and vulnerability index if applicable.
4Click Test Connection to verify Elasticsearch accessibility, then Save.
5Select the new client from the Tenants dropdown in the sidebar to load its data.

Editing / Deleting Clients: Use the Edit and Delete buttons next to each client in the Clients page. Deleting removes the client configuration only — it does not affect the actual Elasticsearch data.

Tip: Use Test Connection before saving to avoid credential errors. The connection status indicator next to each client shows green (connected) or red (unreachable).

Client IDs & Tenant Access Control:

Each client has a unique Client ID (visible in the Clients list). These IDs are used in User Management to control which tenants a user can access:

  • When creating/editing a user, the Allowed Tenants field accepts these Client IDs.
  • Site Admin and Admin roles always see all tenants — the Allowed Tenants setting is ignored.
  • User role: leave Allowed Tenants empty to grant access to all tenants; or select specific tenant IDs to restrict access.
  • If a user's Allowed Tenants list contains tenant IDs that no longer exist, those IDs are simply ignored — the user sees only the remaining valid tenants, or none if all IDs are stale.

👥9. User & Role Management

Manage platform users and their permissions under Administration.

User Roles:

RoleAccess LevelTenant AccessPermissions
Site AdminFullAll tenantsAll pages, user management, client config, role management (create/edit roles), system settings, audit logs
AdminFullAll tenantsAll pages, user management, client config, system settings, audit logs (cannot manage roles)
UserStandardAssigned tenants onlyDashboards, alerts, incidents, threat hunting, endpoints, reports, settings

How Tenant Access Works:

  • Site Admin — Automatically sees all tenants. The allowed_tenants field is ignored and always resolved to "*" (all). Site Admins can also manage roles and permissions.
  • Admin — Also sees all tenants. Same logic as Site Admin but cannot create or edit roles.
  • User — Can only see tenants explicitly assigned. If allowed_tenants is empty ([]), the user also sees all tenants. To restrict a user, assign specific tenant IDs.

Adding a User:

1Go to Administration > User Management and click Add User.
2Fill in Username, Display Name, Password, and select a Role.
3Under Allowed Tenants, select which clients/tenants the user can access. Leave empty for access to all tenants.
4Click Save. The user can now log in with their credentials.

Roles & Permissions: Configure page-level access in Administration > Roles & Permissions. Only Site Admin can create, edit, or delete roles.

Tip: To give a user access to all tenants, set Allowed Tenants to empty. To restrict access, select specific tenants from the list. Site Admin role always sees all tenants regardless of the setting.

🔗10. Integrations & Settings

Integrations (Administration > Integrations) — Configure external tools and feeds. The platform uses a modular integration system that dynamically loads enabled modules. Each module has its own configuration, status indicator, and API key management.

Available Integration Modules:

  • VirusTotal — File, URL, and hash threat intelligence with multi-engine malware detection.
  • AlienVault OTX — Community-driven threat intelligence feeds with pulse-based IoC sharing.
  • AbuseIPDB — IP address blacklist check and reputation scoring for identifying malicious hosts.
  • Shodan — Internet-connected device search engine for exposed service and vulnerability intelligence.
  • AdGuard DNS — Domain-based threat filtering and reputation checks (auto-enabled for DNS events).
  • Blocklist.de — Crowdsourced IP blocklist — no API key required, auto-enabled for IP events.
  • Slack Notifications — Real-time SOC alert delivery to Slack channels via webhook.
  • Email / SMTP — Email-based alert notifications and escalation delivery via SMTP relay.

System Settings (Administration > System Settings) — Platform-wide configuration:

  • Timezone — Set your preferred time display (default: Asia/Manila).
  • SLA Configuration — Define response and escalation deadlines per severity.
  • IR Team — Manage incident response team members and escalation tiers.

Audit Logs — All user actions are logged for compliance. View under Administration > Audit Logs.

📌11. Quick Reference

TaskNavigation Path
View active security alertsAlerts > Active Alerts
Create an incident ticketClick any alert > Create Ticket
Check endpoint statusMonitoring > Endpoint Status
Search for IOCsThreat > Threat Hunting
Configure TI feedsAdministration > Integrations
Add a new clientAdministration > Clients > Add Client
Create a user accountAdministration > User Management > Add User
Configure SLA timersAdministration > System Settings
View audit trailAdministration > Audit Logs
Switch to another tenantTenants dropdown (left sidebar)
Export a reportAnalytics > Export Reports
OrelMSOC v2.0 — Built for Orel Technology Solutions Inc. — View SOPs · FAQs

Standard Operating Procedures

Formal procedures for incident response, case handling, investigations, and daily SOC operations. All analysts must follow these steps for consistency and compliance.

v2.1 — Orel Technology Solutions Inc. — CONFIDENTIAL
DetectAlert triggered
>
TriageAssess severity
>
InvestigateGather evidence
>
ContainStop the threat
>
RemediateRemove & recover
>
CloseDocument & report

1SOP-001: Alert Triage

+

Purpose: To ensure all security alerts are promptly assessed, prioritized, and assigned for action based on severity.

Severity Classification:

CRITICAL
< 15 min
Immediate response required
HIGH
< 30 min
Urgent investigation
MEDIUM
< 4 hours
Standard investigation
LOW
< 24 hours
Routine review

Procedure:

1Monitor — Continuously monitor the Active Alerts and Critical Alerts pages. The dashboard overview shows real-time alert counts.
2Acknowledge — Click on any alert to expand its details. Review the rule description, MITRE ATT&CK mapping, and raw event data.
3Classify — Determine severity based on:
  • Critical: Ransomware, data exfiltration, privilege escalation, active C2 communication, lateral movement confirmed
  • High: Malware detected, brute force success, suspicious admin activity, multiple failed logins from unknown IPs
  • Medium: Single failed login anomalies, policy violations, suspicious but unconfirmed behavior
  • Low: Informational events, minor policy violations, false positive indicators
4Create Ticket — For Critical, High, and relevant Medium alerts, click Create Ticket to open an incident ticket. The alert's metadata is automatically carried over.
5Escalate if Needed — Use the Escalate button for Critical alerts to trigger escalation workflows. SLA timers begin automatically.
Critical: Alerts with Wazuh level 12+ are flagged as Critical. Any alert involving active compromise, ransomware indicators, or confirmed data loss must be treated as Critical regardless of assigned level.

2SOP-002: Case Initiation & Assignment

+

Purpose: To establish a formal process for creating, categorizing, and assigning security cases to appropriate analysts.

When to Open a Case:

  • A ticket has been escalated to Tier 2 or higher
  • Multiple related alerts point to the same threat
  • A confirmed incident requires coordinated response
  • Client notification or formal reporting is required

Procedure:

1Navigate to Incidents > Open Incidents and identify the ticket(s) belonging to the incident.
2Link Related Tickets — In the ticket detail view, associate related tickets and alerts. The platform's correlation engine may already suggest related events.
3Assign Ownership — Use the Assign function to designate a lead analyst. Follow the escalation tier if the incident is beyond Tier 1 capability:
  • Tier 1: Initial triage, basic investigation, false positive clearance
  • Tier 2: Deep investigation, containment, evidence collection
  • Tier 3: Advanced forensics, malware analysis, threat hunting
4Set Priority — Update the ticket severity to match the actual risk level. This drives SLA deadlines and escalation timing.
5Create Investigation Case — Navigate to Incidents > Investigations to group related tickets into a unified case for coordinated response.
Tip: Always check the Correlation Key field on tickets - the auto-correlation engine groups alerts by common indicators (source IP, target host, MITRE technique). Use this to identify related events quickly.

3SOP-003: Investigation & Evidence Collection

+

Purpose: To provide a structured methodology for investigating security incidents and preserving evidence for analysis, reporting, and potential legal action.

Investigation Steps:

1Identify Scope — Determine which systems, users, and data are affected. Check the Endpoints page for affected agents and their last seen status.
2Gather Initial Evidence — Collect from the alert details:
  • Source and destination IP addresses
  • Affected hostnames and agent IDs
  • Timestamp of first and last activity
  • User accounts involved
  • MITRE ATT&CK technique IDs
3Threat Hunt — Use the Threat Hunting page to search for related IOCs. Enter IPs, hashes, domains, or URLs found in the alert. Review results for additional compromise indicators.
4Check Threat Intel — Go to Threat Intelligence to cross-reference IOCs against known threat databases. The platform checks all enabled integration feeds (VirusTotal, OTX, AbuseIPDB, Shodan, Blocklist.de, AdGuard DNS) and aggregates reputation scores for each identified indicator.
5Document Findings — Add detailed Notes to the ticket at each step. Include:
  • What was checked and the result
  • IOCs found and their reputation
  • Systems confirmed affected or cleared
  • Timeline of events
  • Screenshots or raw data excerpts
6Preserve Evidence — Export relevant log data from the alert view. Document the chain of custody in the notes if the incident may have legal implications.
Important: All investigation notes become part of the permanent record. Write clearly and factually. Avoid speculation - state what was observed, not what you "think" happened. If unsure, note it as "unconfirmed" and document what would confirm or rule it out.

4SOP-004: Containment Strategy

+

Purpose: To define actions for stopping the spread of an active threat while preserving forensic evidence.

Immediate Containment Actions:

1Isolate Affected Hosts — If RDP/SSH access is available, disconnect the host from the network. Coordinate with the client IT team if you do not have direct access.
2Block IOCs — Add identified C2 IPs, domains, and hashes to the blocklist. If the organization has a firewall or EDR solution, submit blocking rules through the appropriate channel.
3Disable Compromised Accounts — If user credentials are involved, instruct the client to disable the affected accounts immediately.
4Snapshot Memory/Disks — If forensics capability exists, capture memory dumps and disk images before powering off affected systems.
5Document Containment — Record all actions taken in the ticket notes with timestamps. Include what was blocked, isolated, or disabled.
Critical: Do NOT power off a compromised system before capturing volatile data (memory, running processes, network connections). Once powered off, this evidence is lost forever.

5SOP-005: Remediation & Recovery

+

Purpose: To remove the threat from the environment and restore normal operations securely.

Remediation Steps:

1Remove Malware — Use EDR tools or antivirus to clean affected systems. For severe infections, reimage the host from a known-good backup.
2Patch Vulnerabilities — Identify and patch the vulnerability that was exploited. Check for missing security updates on affected systems.
3Reset Credentials — Instruct the client to reset passwords for all affected accounts. If domain-level compromise is suspected, reset all domain credentials.
4Verify Clean State — Run a full scan on remediated systems. Monitor the Endpoints page to confirm agents are reporting normally.
5Monitor for Recurrence — Keep the case open and monitor alerts for the affected systems for at least 48 hours after remediation. Check the Alert History page for any new related events.
Tip: After remediation, run a Threat Hunt on all IOCs identified during the investigation. If any IOC still triggers results, containment was incomplete - return to the containment phase.

6SOP-006: Escalation Procedure

+

Purpose: To define when and how to escalate incidents to higher-tier analysts, management, or clients.

Escalation Triggers:

TierTriggerEscalate ToMethod
Tier 1 → 2Unable to determine scope, confirmed compromise beyond single host, malware analysis neededTier 2 SOC AnalystTicket reassignment + Slack/Teams notification
Tier 2 → 3Advanced persistent threat, forensic analysis required, zero-day exploitation, multi-tenant breachTier 3 Lead / Threat HunterTicket reassignment + phone call / urgent Slack
Technical → ManagementClient-facing impact, regulatory notification required, SLA breach imminent, data loss confirmedSOC Manager / CTOEmail + phone call + case summary
Management → ClientConfirmed breach, extended downtime, data compromise, formal incident noticeClient Point of ContactFormal incident report + scheduled call

Escalation Steps:

1Identify Escalation Need — Assess if the incident exceeds current tier capability or requires management involvement.
2Use the Escalate Button — On the ticket detail view, click Escalate. The system records the escalation with a timestamp and updates the tier level.
3Prepare Case Summary — Before escalating, ensure all investigation notes are up to date. Include: timeline, affected systems, IOCs identified, actions taken, and gaps that require higher-tier skills.
4Notify the Receiving Party — Send a notification through the appropriate channel (Slack, email, or phone). Reference the ticket/case ID.
5Hand Off — Transfer ownership via the Assign function. Remain available for questions during the transition.
Tip: The platform tracks escalation history automatically. Each escalation is logged with the analyst name, timestamp, and tier level in the audit trail. Use Administration > Audit Logs to review escalation records.

7SOP-007: Communication Protocol

+

Purpose: To ensure clear, consistent, and documented communication during incident response, both internally and with clients.

Internal Communication:

  • Slack/Teams: Use the designated SOC channel for real-time coordination. Tag relevant team members using @ mentions.
  • Ticket Notes: All substantive communication about the case must be recorded in the ticket notes. This creates a permanent audit trail.
  • Shift Handoff: At shift change, document the current case status, pending actions, and any watch items in the ticket notes.

Client Communication:

1Initial Notification — Within 15 minutes of confirming a Critical incident, notify the client point of contact. Provide: what was detected, current impact, actions being taken.
2Status Updates — Send updates every hour (Critical), every 4 hours (High), or daily (Medium) until resolution. Include: actions taken, current status, next steps, ETA for resolution.
3Incident Report — Within 24 hours of case closure, provide a formal incident report summarizing: timeline, root cause, impact, actions taken, recommendations.
4Post-Incident Review — Schedule a post-incident review meeting with the client within 5 business days of closure to discuss lessons learned and preventive measures.
Important: Never share raw log data, internal IPs, or system architecture details with the client without management approval. Always use the formal incident report template.

8SOP-008: Case Closure

+

Purpose: To formalize the closure of security cases with complete documentation and lessons learned.

Closure Checklist:

Case Closure Checklist

Threat fully contained and remediated
All affected systems verified clean
IOCs documented and added to Threat Intelligence database
Root cause identified and patched
All investigation notes complete and final
Closure notes written (summary, impact, actions taken, recommendations)
Client notified of resolution (if applicable)
Incident report submitted
Evidence preserved and archived
Post-incident review scheduled (if required)

Closure Steps:

1Verify Completion — Confirm all checklist items are satisfied. Run a final Threat Hunt for the case IOCs to ensure no residual activity remains.
2Write Closure Notes — In the ticket, add comprehensive closure notes:
  • Executive summary of the incident
  • Timeline of detection, investigation, containment, and remediation
  • Root cause analysis
  • Business impact assessment
  • IOCs identified and action taken on each
  • Preventive recommendations
3Change Status to Resolved — Update the ticket status from In Progress to Resolved. This triggers the SLA clock to stop.
4Await Verification — The ticket remains in Resolved status for 72 hours (or as configured). If no related alerts trigger during this period, proceed to close.
5Close the Case — Change status to Closed. The case is now complete. The case ID (e.g., SOC-2026-00042) becomes a permanent reference for reporting and compliance.
Tip: Closed cases can still be reopened if new evidence emerges. Use the Investigations page to manage reopened cases. The audit log preserves all history.

9SOP-009: Daily SOC Operations

+

Purpose: To define routine daily activities that keep the SOC operational and ensure no alerts go unhandled.

Start of Shift Checklist:

1Check Dashboard — Review the Overview page for total alert counts, critical alerts, and endpoint status across all tenants.
2Review Open Incidents — Check Incidents > Open Incidents for any tickets that were updated during off-hours.
3Check SLA Deadlines — Review all active tickets for approaching SLA deadlines. Prioritize tickets nearing escalation thresholds.
4Review Escalations — Check Alerts > Escalations for any tickets that were escalated during the previous shift.
5Check Integration Health — Navigate to Administration > Integrations and verify all configured modules show green status. Failed integrations can cause missed TI enrichment and notification delays.
6Check Threat Intel Updates — Review Threat Intelligence for any new IOCs added by the platform's auto-enrichment or by other analysts.
7Switch Tenants — Use the Tenants dropdown to cycle through all active clients. Ensure each tenant's data is loading correctly and no ES connections are down.
8Document Shift Notes — Record any notable events, ongoing investigations, or items requiring follow-up in the shift handoff notes.
Tip: If the connection status indicator in the sidebar shows red for any tenant, notify the senior analyst immediately. A red status means the Elasticsearch backend is unreachable.

10SOP-010: User & Tenant Administration

+

Purpose: To define procedures for creating and managing users, assigning roles, and controlling tenant access across the OrelMSOC multi-tenant platform.

User Role Definitions:

RoleTenant ScopeRole ManagementUse Case
Site AdminAll tenantsCan create/edit/delete rolesSystem-wide administrator — full platform control
AdminAll tenantsCannot manage rolesTenant-wide administrator — manage users, clients, settings
UserAssigned tenants (or all if empty)Read-onlyStandard SOC analyst — alert triage, incidents, investigations

Procedure A: Creating a New User

1Navigate to Administration > User Management and click Add User.
2Fill user details — Username (unique, lowercase), Display Name, Password (min 4 chars).
3Assign role — Select Site Admin, Admin, or User based on the role definitions above.
4Set Allowed Tenants:
  • Site Admin / Admin — The Allowed Tenants field is informational only. These roles always see all tenants.
  • User — Leave blank to grant access to all tenants. Select specific tenant IDs to restrict access to those tenants only.
5Save — The user is created. Verify by logging in with the new credentials.

Procedure B: Modifying User Access

1Go to Administration > User Management and click Edit on the target user.
2Update the Role or Allowed Tenants as needed.
3Changing a role from User to Admin or Site Admin grants immediate access to all tenants. The user must log out and log back in for the change to take effect.
4Changing a role from Admin to User revokes all-tenant access. The user will only see tenants listed in their Allowed Tenants field after re-login.

Procedure C: Managing Roles & Permissions

1Only Site Admin can access Administration > Roles & Permissions.
2Select a role to edit its section-level page permissions. The sections list controls which sidebar pages each role can view.
3The default User role has access to: Dashboard, Live Status, System Health, Alerts, Critical Alerts, Alert History, Escalations, Cases, Threat Hunting, Threat Intelligence, Investigations, MITRE, Resolved Incidents, Endpoints, FIM, Asset Inventory, Servers, Security Reports, Operational Metrics, Trends, Export Reports, User Guide, FAQs, and Settings.
4Use ["*"] to grant access to all sections (default for Site Admin and Admin roles).

Important Tenant Access Notes:

  • Empty Allowed Tenants (JSON []) is treated by the login system as "*" — meaning access to all tenants. This applies to ALL roles.
  • Site Admin role forces allowed_tenants = '[]' on every server startup — Site Admins always see all tenants and cannot be restricted.
  • To restrict a User to specific tenants, explicitly select those tenant IDs in the Allowed Tenants field. Empty = all, explicit list = only those.
  • When a user logs in, the JWT token includes their tenant access list. Token refresh (re-login) is required after tenant permission changes.
Important: When migrating from a single-tenant to multi-tenant setup, existing admin users are automatically upgraded to site_admin role to preserve their full access. New users should be assigned the appropriate role based on their responsibilities.

11SOP Reference & Quick Guide

+
SOP IDTitleWhen to Use
SOP-001Alert TriageEvery time a new alert appears in the dashboard
SOP-002Case Initiation & AssignmentWhen a ticket needs formal case structure or multi-analyst coordination
SOP-003Investigation & Evidence CollectionWhen investigating any confirmed incident or suspicious activity
SOP-004Containment StrategyWhen an active threat is confirmed on a host or network
SOP-005Remediation & RecoveryAfter the threat is contained and systems need cleanup
SOP-006Escalation ProcedureWhen an incident exceeds current tier capability or requires management
SOP-007Communication ProtocolThroughout the incident lifecycle for internal and client communications
SOP-008Case ClosureWhen remediation is verified and the case is ready to close
SOP-009Daily SOC OperationsStart of every shift and throughout the day
SOP-010User & Tenant AdministrationWhen creating users, assigning roles, or managing tenant access
All SOPs are mandatory for SOC analysts. Violations must be documented. — Orel Technology Solutions Inc.

Frequently Asked Questions

Common questions about the OrelMSOC platform — from daily operations to troubleshooting. Click a question to expand the answer.

Last updated: May 2026

?Getting Started

How do I log in to the OrelMSOC platform?+

General

Navigate to your OrelMSOC URL in any modern browser. Enter your Username and Password (provided by your administrator) and click Sign In. If you don't have credentials, contact your SOC manager or system administrator.

Default credentials for first-time setup: admin / orelmsoc2026 (change immediately after first login for security).

I forgot my password. How do I reset it?+

GeneralAdmin

Password reset is handled by administrators:

  • Contact your SOC manager or another admin user.
  • The admin goes to Administration > User Management, clicks Edit on your account, and sets a new password.
  • There is currently no self-service password reset feature. This is planned for a future release.
Why is the Tenants dropdown empty?+

GeneralAdmin

If the Tenants dropdown only shows "-- Select Client --" with no options:

  • No clients configured: An admin needs to add clients under Administration > Clients.
  • Permission restriction: Your account may not have access to any tenants. Contact an admin to check your Allowed Tenants setting in User Management.
  • Session expired: Try logging out and back in. If the issue persists, clear your browser cache and hard refresh (Ctrl+Shift+R).
  • Server issue: Check if the backend server is running. If you see a red connection indicator in the sidebar, the ES backend may be unreachable.
What browsers are supported?+

General

OrelMSOC supports the latest versions of:

  • Google Chrome (recommended)
  • Mozilla Firefox
  • Microsoft Edge (Chromium-based)
  • Opera

Internet Explorer and legacy Safari versions are not supported. The platform requires JavaScript enabled.

!Alerts & Monitoring

What is the difference between Active Alerts and Critical Alerts?+

Alerts

Active Alerts shows all incoming security alerts across all severity levels (Low to Critical) from the selected tenant.

Critical Alerts filters to show only alerts with Wazuh severity level 12 and above. These are the most dangerous events requiring immediate attention — ransomware, active C2 communication, privilege escalation, and confirmed data exfiltration.

Both pages allow ticket creation, escalation, and detailed inspection.

How do I create a ticket from an alert?+

AlertsCases

1 Click on any alert to expand its details.
2 Review the alert details — rule description, MITRE mapping, event data.
3 Click Create Ticket. A new incident ticket is generated with the alert's metadata pre-populated.
4 Navigate to Incidents > Open Incidents to find and manage your new ticket.
Why am I not seeing any alerts on the dashboard?+

AlertsTroubleshooting

Possible reasons:

  • No tenant selected: Make sure you have selected a client from the Tenants dropdown in the left sidebar.
  • ES connection down: Check the connection status indicator in the sidebar footer. Red means the Elasticsearch backend is unreachable.
  • No recent alerts: The environment may not have triggered any alerts in the selected time window. Try expanding the time filter or checking a different tenant.
  • Index mismatch: The client's alert index prefix may be misconfigured. Check under Administration > Clients and verify the alert index prefix matches your Wazuh ES index pattern.
  • Browser cache: Try a hard refresh (Ctrl+Shift+R) or open in an incognito window.
What do the MITRE ATT&CK IDs mean on alerts?+

Alerts

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. Each alert may include:

  • Tactic: The high-level goal (e.g., TA0006 - Credential Access, TA0005 - Defense Evasion)
  • Technique ID: The specific method used (e.g., T1110 - Brute Force, T1562 - Impair Defenses)

You can click the Case Timeline page under Incidents to view the full MITRE ATT&CK matrix mapped against your active cases. This helps identify attack patterns and coverage gaps.

#Cases & Incidents

What is the difference between a Ticket, a Case, and an Investigation?+

Cases

  • Ticket: A single incident record created from an alert or manually. Contains all details about one specific security event.
  • Case: A grouping of related tickets under a unified identifier (e.g., SOC-2026-00042). Created when multiple tickets are related to the same incident.
  • Investigation: A workspace for managing a case. Here you can see all linked tickets, notes, and the overall incident timeline.

Workflow: Alert → Ticket → Link related tickets → Create Case/Investigation → Investigate → Resolve → Close.

How do I assign a ticket to another analyst?+

Cases

Open the ticket from Incidents > Open Incidents. In the ticket detail view, find the Assign button or dropdown. Select the analyst you want to assign the ticket to. The ticket ownership updates immediately, and the assigned analyst will see it in their queue.

If the target analyst doesn't appear in the assignee list, make sure they have a user account in the platform and the appropriate role.

What happens when a ticket's SLA deadline is approaching?+

CasesSOP

The platform automatically tracks SLA deadlines based on severity:

  • Critical: Response within 15 minutes, escalation at 30 minutes
  • High: Response within 30 minutes, escalation at 1 hour
  • Medium: Response within 4 hours, escalation at 8 hours
  • Low: Response within 24 hours

When an SLA deadline is approaching, the ticket displays a warning indicator. If the deadline passes without action, the system logs an SLA breach and automatically triggers escalation notifications. Admins can configure SLA thresholds under Administration > System Settings.

Can I reopen a closed case?+

Cases

Yes. Navigate to Incidents > Resolved Incidents, find the closed case, and change its status back to In Progress or New. The system preserves all original notes, evidence, and escalation history. A new audit log entry is created recording the reopening.

Reopening is appropriate when new evidence emerges or related alerts appear after closure.

@Administration

How do I add a new user to the platform?+

Admin

Only users with the Site Admin or Admin role can create new users. Follow these steps:

  • Go to Administration > User Management.
  • Click Add User and fill in the form: Username, Display Name, Password, and Role.
  • Available Roles: Site Admin (full access, can manage roles), Admin (full access, cannot manage roles), User (standard analyst, restricted by assigned tenants).
  • Under Allowed Tenants, select which clients the user can access. Leave empty for access to all tenants (Site Admin and Admin roles always see all tenants regardless).
  • Click Save. The user can now log in with their credentials.
What is the difference between Site Admin and Admin roles?+

Admin

Both roles have full access to all platform pages and features, but the key difference is role management:

  • Site Admin — Can access Administration > Roles & Permissions to create, edit, and delete roles and their section-level permissions. This is the highest privilege level.
  • Admin — Cannot manage roles. Can manage users, clients, integrations, settings, and audit logs, but the Roles & Permissions page is hidden.

Both roles see all tenants by default. The allowed_tenants setting is ignored for these roles.

Migration note: Existing admin users from previous versions were automatically upgraded to site_admin to preserve their existing access.

How do I connect a new Elasticsearch/Wazuh client?+

Admin

1 Go to Administration > Clients and click Add Client.
2 Enter: Client Name, ES URL (e.g., https://your-es:9200), ES Username, and ES Password.
3 Set the Alert Index Prefix (default: orelmsoc-alerts) and Vulnerability Index if needed.
4 Click Test Connection to verify. Then click Save.
5 Select the new client from the Tenants dropdown to verify data loads.
How do I configure SLA thresholds?+

Admin

Go to Administration > System Settings and scroll to the SLA Configuration section. You can set:

  • Response Hours — Time allowed before initial response is required
  • Escalation Hours — Time before the ticket auto-escalates to the next tier
  • Response Label — Display name for the response window (e.g., "15 mins", "4 hours")
  • Escalation Label — Display name for the escalation window

Each severity level (Critical, High, Medium, Low) has its own SLA configuration. Changes take effect immediately for all new tickets.

What integrations are available and how do I set them up?+

Admin

The platform includes 8 integration modules under Administration > Integrations:

  • VirusTotal — Requires a VirusTotal API key. Used for file, URL, and hash reputation checks.
  • AlienVault OTX — Requires an OTX API key. Community threat intelligence pulse feeds.
  • AbuseIPDB — Requires an AbuseIPDB API key. IP blacklist and reputation scoring.
  • Shodan — Requires a Shodan API key. Device fingerprinting and service exposure data.
  • AdGuard DNS — Toggle on/off. No API key needed — auto-enabled for DNS events.
  • Blocklist.de — Toggle on/off. No API key needed — auto-enabled for IP events.
  • Slack — Requires a Slack incoming webhook URL for channel delivery.
  • SMTP — Requires SMTP server host, port, username, and password for email notifications.

Each module shows its status (green = configured, yellow = untested, red = not configured). API keys are stored encrypted. Toggle modules on/off anytime.

Can I delete a client configuration without affecting their data?+

Admin

Yes. Deleting a client from Administration > Clients only removes the connection configuration from the OrelMSOC platform (ES URL, credentials, index settings). It does not delete or modify any data in the client's Elasticsearch instance.

If you need to reconnect the client later, you can add them again with the same credentials. All historical alert data remains intact on their ES backend.

Troubleshooting

The dashboard shows "Connection Error" or no data. What do I do?+

Troubleshooting

  1. Check the Tenants dropdown — Make sure a client is selected.
  2. Check connection status — Look at the bottom of the sidebar. Green = connected, Red = unreachable.
  3. Test the connection — Go to Administration > Clients and click Test Connection next to the affected client.
  4. Verify ES credentials — The ES URL, username, or password may have changed. Edit the client to update them.
  5. Check if the ES server is running — The issue may be on the Elasticsearch side, not the platform.
  6. Restart the platform — If all else fails, try restarting the OrelMSOC backend service.
I see "-- Select Client --" but no clients in the dropdown. Why?+

Troubleshooting

This typically means one of the following:

  • No clients configured: An administrator needs to add clients under Administration > Clients first.
  • Browser cache: The page may be loading an old cached version. Perform a hard refresh (Ctrl+Shift+R) or clear your browser cache.
  • Session token expired: Log out and log back in. If the page was restored from a previous session but the token expired, the dropdown may appear empty.
  • Permission restriction: Your account may have Allowed Tenants set but no matching clients. Contact your admin.

Quick fix: Open an incognito/private window and navigate to the platform URL. If clients appear there, the issue is definitely browser cache.

Pages are not loading or showing old data. What's wrong?+

Troubleshooting

This is most often a browser caching issue. The OrelMSOC platform uses no-cache headers now, but if you loaded the page before those headers were added, your browser may still serve an old cached version.

Solutions (in order):

  • Hard refresh: Ctrl+Shift+R (Windows/Linux) or Cmd+Shift+R (Mac)
  • Open DevTools (F12), go to Network tab, check "Disable cache", then refresh
  • Clear all site data: DevTools > Application tab > Clear site data
  • Try an incognito/private window
  • Clear your browser cache completely: Settings > Privacy & Security > Clear browsing data
Why is the platform displaying incorrect times?+

Troubleshooting

Check your timezone setting:

  • Go to Administration > System Settings.
  • Find the Timezone setting. The default is Asia/Manila (UTC+8).
  • Select your correct timezone and save.

Note: Timestamps in alert data come directly from Elasticsearch and are displayed in the configured timezone. Raw event timestamps in UTC are also available in the alert detail view.

No matching questions found.

Try different keywords or browse the categories above.

Still have questions? Contact your SOC manager or system administrator.
📰

Release Notes

Version history, changelog, and feature updates for the OrelMSOC platform.

User Management

UsernameDisplay NameRoleActions

Roles & Permissions

Users by Role

Loading users...

Section Access Matrix

Loading matrix...

Incident Management

Triage SLA Response Response Team Workflow Notifications
Open Incidents
-
Overdue SLA
-
Avg Resolution
-
Auto-Created
-
Triage Classification Rules

How incoming alerts are classified and routed through the incident workflow.

Severity Quick Reference
Reset Open Incidents

Delete all open incidents and reset the case ID sequence back to SOC-{year}-00001. Closed/resolved incidents are preserved. This action cannot be undone.

Connected Clients

Connection Info

Each client connects via Elasticsearch on port 9200. Configure credentials and index patterns for multi-tenant monitoring.

Integrations
0
Total
0
Connected
0
Not Configured
0
Errors

System Configuration

Wazuh ES: 34.57.242.118:9200
Backend: FastAPI (SQLite)
Client: Orel Technology Solutions
Version: 2.0

Timezone Setting

SLA Configuration

Loading SLA config...

Incident Response Team

Loading team members...