solutions

Security Information & Event Management

Identify, analyze, and recover security threats in real-time through our SIEM solutions.

Security Information and Event Management (SIEM), is a security and compliance management solution that provides organizations with the ability to collect, monitor, analyze, and identify security threats within a central solution.

HOW IT WORKS

A SIEM solution will accept logs from devices across the network in hopes of detecting malicious or “not normal” behavior. This is possible because custom rules can be created within the SIEM application when identifying this type of behavior:

  • Custom rules and policies are created to monitor for suspicious activity among IT assets to alert on “not normal” behavior.
  • Targeted systems deliver logs to the SIEM solution
  • The SIEM solution analyzes all data and correlations
  • Incidents are created and logged
  • Users access the SIEM solution with defined roles and triage incidents with a defined workflow.

BENEFITS OF SIEM

  • Federal laws and regulations require organizations to maintain and backup log data.
  • Provides real-time threat detection and security incident response based on a wide variety of vendor event sources, including network devices, databases, firewalls, IDS/IPS systems, and anti-virus environments.
  • Advanced correlated rules can be created across multiple log types and event sources.
  • Heavy focus on compliance requirements with custom reporting and metrics
  • Newer SIEM solutions offer insight into “big data” environments by performing real-time network packet captures to provide additional information on how attackers could have gained access to the network.

CipherTechs FOCUS

CipherTechs offers managed services around the deployment and ongoing management of a SIEM solution with a core focus on the following:

  • Planning and implementing architecture
  • Custom policy and correlated rule creation
  • Best practices with device integration
  • Custom reporting and metrics for audit and regulation concerns
  • Training and knowledge transfer to become familiar with SIEM products
  • Agnostic vendor comparisons