SIEM – SOC Management

Benefits of SIEM - SOC Management

SIEM and Security Monitoring with Wazuh

Wazuh is an open source security platform that unifies XDR and SIEM capabilities. We install the Wazuh agent on your systems and collect and analyze the logs on a central server. We tune the file integrity monitoring, malware detection, vulnerability detection and configuration assessment rules for your environment. Our SOC team monitors security events 24/7, examines the alarms and shares the incident record with you.

What are SIEM and SOC, and how do they differ?

SIEM (Security Information and Event Management) is the technology that collects logs from different systems in one platform, correlates them and raises alarms. A SOC (Security Operations Center) is the team and the process that examine these alarms and manage the incident response.

SIEM alone is not enough. The rule set must be tuned for your environment, and an analyst must examine the alarms. Otherwise false alarms hide real incidents. Our SIEM – SOC service gives you the platform and the analyst team together.

Which log sources are monitored?

We define the sources to monitor together with you, based on your environment. Typical sources are:

• Windows and Linux servers: security event logs, logon attempts and file integrity changes.
• Firewalls and network devices: blocked connections, VPN sessions and configuration changes.
• User computers: malware and vulnerability detection findings of the Wazuh agent.
• Business applications and databases: logs of the applications defined in the scope.

According to the vendor, Wazuh also offers capabilities for container security and cloud workload protection. We agree with you in the service contract whether these sources are in scope.

How does the SIEM – SOC service work?

1. Source definition: We list the systems and log sources to monitor together with you.
2. Installation: We install the Wazuh agent on your systems and collect the logs on a central server.
3. Rule tuning: We tune the file integrity, malware, vulnerability and configuration rules for your environment.
4. Monitoring: We monitor security events 24/7.
5. Assessment: Our SOC analysts examine the alarms.
6. Notification: In a real incident we contact you with the recommended action and share the incident record.
7. Records and reporting: We keep records of security events and responses and provide them in a report for audits.

Threat indicators come from our Cyber Threat Intelligence (CTI) Management service and serve as rules and correlation in SIEM – SOC. Within Firewall Management we can forward firewall logs to the SIEM system. We verify detected vulnerabilities with Penetration Testing.

Our Solution Partners