SIEM-as-a-Service
We take the pain out of SIEM
SIEM, based in the cloud, run by experts
SIEM-as-a-Service collects, filters and correlates security events from firewalls, IPS, servers, applications, and virtually any critical asset in your environment on a 24×7 basis. It is using the best SIEM tools in the industry to perform the Security Information and Event Management for your environment.
- Cloud based subscription model with no administration or maintenance
- ArcSight advanced log management and SIEM technology
- Out-of-the-box log collection from over 350 event sources
- Cross-device correlation and modeling of critical assets
- 24×7 automated alerting and notification
- Web portal with easy-to-use dashboards and reports
- Customised event thresholds, use cases, and correlation rules
From one simple to understand, but detailed portal, you have complete visibility and intelligence on what is really happening in your environment, enriched by some of the most advanced security intelligence platforms available.
We take the pain out of SIEM, based in the cloud and ready for you.
Focus on knowledge, not data.
The ability to accurately prioritise and short list security incidents is critical to enabling an effective and rapid response. Our experts will work with your team to model critical assets and configure SIEM use cases and correlation rules to identify the security alerts that are most relevant. Your IT team will not be swamped with false positives, and can use their valuable time to resolve issues that really matter.
Full visibility and access to security logs with a summary of the state of their security and includes:
- Operational dashboards
- Reports for security, management, and compliance
- Full access to security event logs
- Drill down analytics
- Role-based and user-based views
- Case management
Supplement your existing IT security
If your existing platforms are not up to the tasks of feeding data to a SIEM, it is easily possible to augment your security with a range of services to help.
- PERIMETER PROTECTION: with a SIEM compatible firewall with IDS/IPS as well as UTM from Palo-Alto Security
- END-POINT PROTECTIONS: based on AV technology that can sit on every server or desktop in your organisation providing not only security services such as malware protections, file scanning, and Anti-Virus, but feeding security data up to the SIEM
- CUSTOM DEVICES: As long as your device supports syslog, or file access to logs, we can integrate those into the onsite log management servers with custom collectors, that translate the raw data into security events for the SIEM to act on.
- EXISTING ARCSIGHT ENVIRONMENTS: The SIEM as a Service is 100% compatible with ArcSight, and existing environments are easily integrated into the cloud based SIEM as a SERVICE.
Easily works in your IT environment
The SIEM-as-a-Services is compatible with many common environments in use today, and has the flexibility to be tailored to bespoke applications or systems that may be in place in your organisation.
PLATFORM
- Cloud compatibility with AWS and Azure detailed event and activity monitoring through the vendor tools.
- Internal server environments, based on Windows or LINUX.
- Desktop monitoring capability.
DEVICES:
- Fortinet, Cisco, Juniper, Palo Alto + more
- IPS/IDS systems
- Network devices
- WiFI environments
- Remote User/VPNs
SECURITY APPLICATIONS
- Email platforms
- Anti-Virus systems
- Splunk/RSA plus other monitor systems
- Traffic TAPS and monitors
- Splunk Installations
- Existing SIEM/security platforms
- DNS/AD/user management systems
OPERATING SYSTEM and APPLICATIONS
- Windows/Linux/HP/IBM
- Web servers
- Data base platforms
Apply the best Technology to your security environment
The result of having a SIEM-as-a-Service is:
- Knowing that all your systems are being automatically monitored.
- Having visibility over risk in the business.
- Enjoying the ability to thoroughly investigate suspicious activity from external or internal users.
- Reporting up to your board that your environment is logged and monitored.
- Being in control of your security and monitoring 24/7.
The SIEM as s Services provides you with visibility and insight into the security of your organisation and IT environments.
Easily add a SIEM
With a easy to have discussion, we can put together a solution and plan for your business with:
- Strategic IT security and IT risk consulting.
- Environment risk assessment.
- SIEM log architecture and capability analysis.
- Event action/Notification/ Prioritisation Matrix.
- System training and trial event tests.
- Ongoing environment updates..
The SIEM as a Service does require a virtual (or physical) server running our proprietary log capture and compression technology as well as a path to the internet to efficiently transfer live logs to the cloud based collectors. The components should be within the capability of any IT environment, and remote assistance is available for initial setup, however no ongoing expertise is needed to run this system.
The benefits of cloud based SIEM
- Lower total cost of ownership
- No upfront investment in resources like hardware, software and people.
- Unlike traditional SIEM, there is no upfront hardware, software or specialists investment.
- Reuse your existing security. Correlate events From multiple sources
- Capture logs and information from your existing systems and technology, or deploy additional components for a complete security view.
- Scalable and adaptable technology in the cloud.
- Enjoy the cloudspeed security story with SIEM capability that can grow with you, with guaranteed uptime and performance.
- Manage and analyze your security from anywhere
- With an easy to use and familiar portal in the cloud, that can be used by experts and non-experts alike which can integrate into existing operations ITSM platforms.
The magic of correlation
Correlation applies intelligence to logs from different devices or events. Imagine an attack sequence, where an unknown application is accidentally installed on malware, and then PingScans and SMB requests begin to originate from that same server. Each by themselves, make not trigger interests, but combined they tell a story of a malware attack. Or a user account on a cloud application is being used that is marked as ‘retired’ in the active directory. Correlation aims to make sense of the thousands of non-descript events that exist in any organisation, and pinpoint the exact threat when is occurs in real time.
Got an existing SIEM that’s not working for you?
You may have an existing SIEM installation, or have configured your own solutions with rules and triggers. Is it working well for you? Can you keep up with the changes in your environment? Have your staff stopped looking at the choked red screens?
SIEM-as-a-Service can either replace, or append to your existing technology and cut through the clutter.