PassIRP — EU-hosted SIEM & incident response
The engine behind Passeca's SOC-as-a-Service and MDR. Log ingestion, correlation, detection and case management with EU data residency and sovereign hosting — a genuine advantage for German and EU-regulated buyers.
PassIRP is Passeca's SIEM and incident-response platform. It centralises log ingestion, correlation, detection and incident case management, and runs with EU data residency and sovereign hosting. PassIRP is the engine behind Passeca's SOC-as-a-Service and MDR — the platform Passeca's own analysts work in, not a product it merely resells.
What is PassIRP?
The SIEM and incident-response platform at the centre of Passeca's managed detection and response.
PassIRP is the Security Information and Event Management (SIEM) and incident-response platform operated by Passeca. It performs the core SIEM functions — log collection, normalisation, storage, correlation and detection — and adds integrated incident case management so every confirmed detection is tracked from triage through to closure.
PassIRP is not a dashboard Passeca points at someone else's data. It is the working environment of Passeca's 24/7 SOC analysts, which means the platform is exercised continuously and improved against real incidents rather than demoed and left.
EU data residency and sovereign hosting
PassIRP runs with EU data residency. Detection data, logs and incident cases remain within the EU under GDPR, with on-premises and hybrid options for organisations that require full sovereign hosting or air-gapped operation.
For German public sector, Mittelstand, and BSI C5 or NIS2-scoped organisations, this is a purchasing criterion, not a nice-to-have. US-headquartered SIEM vendors can offer European regions, but their parent companies remain subject to US data-access laws. EU data residency and German-operated hosting can help organisations address data-sovereignty requirements.
What does PassIRP actually do?
Five concrete capabilities — not adjectives.
Log ingestion & normalisation
PassIRP collects logs from endpoints, servers, cloud platforms, network gear, SaaS and security tools, normalising them into a unified schema so events from different sources can be correlated.
Correlation & detection
Detection rules and behavioural analytics correlate events across the estate — surfacing the multi-stage attacks that no single tool sees on its own.
Incident case management
Every confirmed detection becomes a case: enriched, tracked, assigned and escalated through to closure, with a full chain of evidence for audit and forensics.
Threat intelligence integration
PassIRP ingests Signals threat-intel feeds and external sources, so detections are enriched with indicators, adversary context and known-bad infrastructure.
Reporting & compliance evidence
Built-in reporting supports operational SLAs and regulatory evidence — incident timelines, response metrics and audit trails for ISO 27001, NIS2 and DORA.
What data sources can PassIRP ingest?
The value of a SIEM is bounded by what it can see.
How does PassIRP work?
Collect, correlate, detect, manage — and hand off to PassAI-Guard.
PassIRP follows the classic SIEM workflow, hardened for 24/7 operation. Collectors and agents forward logs to the platform, where they are normalised into a unified schema. Detection rules and behavioural analytics then correlate across sources — joining an endpoint event, an identity event and a network event into a single picture of an attack in progress.
Confirmed detections become incident cases: enriched with threat intelligence from Signals, assigned, escalated and tracked through to closure with a full evidence chain. PassAI-Guard sits on top of this workflow, automating the triage, enrichment and response steps so that the alerts which don't need a human never reach one.
How can PassIRP be deployed?
Three models, selected according to your sovereignty and operational requirements.
Cloud (EU-hosted SaaS)
PassIRP operated by Passeca in EU data centres — fastest to stand up, no infrastructure to manage, ideal for most mid-market and enterprise customers.
On-premises
PassIRP deployed inside your environment for data-sovereignty or air-gapped requirements — common in public sector, defence and regulated manufacturing.
Hybrid
Collectors on-premises with the analysis and case-management layer in EU cloud — balances sovereignty with operational efficiency for distributed estates.
How PassIRP powers SOC-as-a-Service and MDR
The platform is the service: Passeca’s analysts work directly in PassIRP, so the service and the platform are one and the same.
SOC-as-a-Service and MDR are not a separate layer bolted onto a third-party SIEM. They are Passeca analysts operating inside PassIRP — ingesting your logs, running detections, managing incidents and responding 24/7. Because Passeca controls the platform, detection engineering, tuning and response happen without the friction of a vendor boundary.
PassAI-Guard automates the repetitive triage and enrichment, and Passeca Deception contributes high-fidelity indicators, while Signals injects dark-web and leaked-credential intelligence. The result is one detection and response stack, operated as one service.
PassIRP, answered
The questions buyers ask before adopting PassIRP or moving off an incumbent SIEM.
What is PassIRP?
Is PassIRP a SIEM?
Where is PassIRP data hosted?
What data sources can PassIRP ingest?
Can PassIRP replace Splunk, QRadar or Sentinel?
How does PassIRP relate to PassAI-Guard?
What deployment options are available?
How do I get PassIRP?
See PassIRP running in your environment
Request a demo and Passeca will scope the deployment model, data sources and detection use-cases to your estate — cloud, on-premises or hybrid.
Related