العربية Request a demo
04 — Tickets, SOC, and operations
  1. CSpace One
  2. CSpace 360
  3. CSpace Pro
  4. CSpace Elite

CSpace Elite

Coordinate cybersecurity operations across analysts, incidents, tickets, and clients.

Manage service requests, incident workflows, escalation, response activity, and managed security operations from a shared platform.

Request a demo Capability modules
  • Available now1
  • In development6
  • Planned1
What it covers

CSpace Elite supports cybersecurity service operations across clients, analysts, incidents, tickets, escalations, and response activities. It is intended for MSSPs, SOC teams, cybersecurity service desks, and organizations that need operational control beyond assessment and scanning.

  • 01

    Tickets

    Support and remediation tickets associated with clients and findings, with category, priority, ownership, and activity.

  • 02

    Incidents

    Incident records with severity, assignment, escalation, affected clients and assets, timelines, and closure summaries.

  • 03

    SOC operations

    A cross-client queue with analyst assignment, investigation workflow, and approval for sensitive response actions.

  • 04

    Service levels

    Response and resolution targets with severity-based rules, breach warnings, and escalation paths.

Capability modules — CSpace Elite

What the product does, and what state each part is in.

  • Available now
  • Available with configuration
  • In development
  • Planned
  1. 01
    Available now

    Support ticketing

    Tickets that connect clients, findings, owners, and deadlines while keeping tenants separate.

    • Create tickets
    • Associate tickets with clients
    • Associate tickets with findings
    • Set category
    • Set severity or priority
    • Assign ownership
    • Track status
    • Add comments
    • Record activity
    • Manage remediation deadlines
    • Request retesting
    • Close resolved work
    • Maintain tenant separation
  2. 02
    In development

    Security incident management

    A record of each incident from detection to lessons learned.

    • Incident records
    • Severity and status
    • Assignment and escalation
    • Affected clients and assets
    • Timelines
    • Investigation notes
    • Containment actions
    • Recovery tracking
    • Lessons learned
    • Closure summaries
  3. 03
    In development

    SOC operations

    Cross-client operations for analysts with management approval for sensitive actions.

    • Cross-client incident queue
    • Analyst assignment
    • Incident severity
    • Escalation
    • Investigation workflow
    • Recommended response actions
    • Management approval for sensitive actions
    • Client communication
    • Activity history
    • Operational reporting
  4. 04
    In development

    Recommended response actions

    Suggested next steps presented for review, not executed autonomously.

    • Block an IP address
    • Isolate a host
    • Investigate an account
    • Reset credentials
    • Collect additional evidence
    • Escalate an incident

    NoteSensitive actions require review and approval. CSpace 360 does not perform autonomous containment unless that capability is confirmed and configured.

  5. 05
    In development

    SLA management

    Targets, rules, warnings, and reporting for response and resolution.

    • Response targets
    • Resolution targets
    • Severity-based rules
    • Due dates
    • Breach warnings
    • Escalation paths
    • Analyst and client performance views
    • SLA reports
  6. 06
    In development

    SIEM query assistance

    Security-event views and assisted query preparation for investigations.

    • Security-event views
    • Event timelines
    • Source and severity filters
    • Assisted query preparation
    • Investigation summaries
    • Security-assistant support

    NoteFull SIEM ingestion and vendor-specific SIEM connectors are labeled according to the integrations available in the production environment.

  7. 07
    In development

    Threat intelligence

    Indicator records with status, source, confidence, and related incidents.

    • Indicator tracking
    • IP, domain, URL, and file-hash records
    • Indicator status
    • Source information
    • Confidence and severity
    • Investigation notes
    • Related incidents
    • External feed integrations
  8. 08
    Planned

    Digital forensics

    Investigation cases with evidence records and chain-of-custody information.

    • Investigation cases
    • Evidence records
    • Chain-of-custody information
    • Artifact collection
    • Timeline reconstruction
    • Analyst notes
    • Case reports
How the work moves

Workflow

SOC workflow

10 steps
  1. 01 Receive incident or security event
  2. 02 Set severity
  3. 03 Assign analyst
  4. 04 Investigate
  5. 05 Recommend response
  6. 06 Obtain approval where required
  7. 07 Coordinate action
  8. 08 Record timeline
  9. 09 Resolve
  10. 10 Report
Good to know

Positioning we stand behind.

Approval before action

Recommended response actions are presented for review. Sensitive actions require approval, and no autonomous containment is implied unless it has been confirmed and configured.

Integrations by environment

SIEM platforms, ticketing systems, threat-intelligence feeds, and other external integrations are in development. Only connectors confirmed in the production environment are listed as available.

Next step

See CSpace Elite in a demonstration built around your requirements.

We will walk through the workflows that matter to your organization or service model, with the capability status of each module made clear.

Request a CSpace Elite demo Talk to a cybersecurity specialist