Because Security Gives Us Freedom.
Security Management & Reporting
Panoptic Cyberdefense Goal: mitigate risk, protect sensitive data, provide visibility to upper management, elevate your security team, all while satisfying compliance requirements.
True threats (high value alerts) need to be separated from your network’s high volume of benign traffic, and require immediate attention. Outsourced Security Management & Reporting, as part of our Panoptic Cyberdefense managed service, offers this peace of mind without the cost or hassle of operating a Security Incident & Event Manager (SIEM).
Accepting security data from all systems in your network into our ELK Stack-based (SIEM) – or yours, if you have one that you can trust – we will monitor, correlate, and alert on threats, anomalies, and compliance violations 24/7.
Our SIEM and alerting systems are in our private cloud. We place a log collector on your site or use your existing SIEM if you prefer. In concert with our Panoptic Approach, our SIEM accepts almost any output from Active Directory, firewalls, intrusion detection systems (IDS), data loss prevention (DLP) systems, endpoint detection, and many others.
How onShore Security Management & Reporting Works
Security Event & Log Correlation
Correlation of security data is the heart of security management. But we go beyond that with rule customization and data tools that empower the analyst to detect threats, anomalies, and compliance violations.
onShore ELK Stack-Based SIEM
Receive only truly actionable information and alerts. Our SIEM uses the most advanced analytics available. If you already have a SIEM, we'll manage it for you.
24/7 Threat-Level Alerting
Our SOC will alert via ticket, API, email, or phone based on custom, agreed-upon criteria. We use the Information Technology Infrastructure Library (ITIL) categories and severity levels.
Analyze Log, End-point, SNMP, API Data
We'll customize to accept most any log source. Of course we're ready for your AD, firewalls, IDS, DLP, end-point detection and more. Unlike the others, we also analyze switches (SNMP) for parameters not found in logs.
SIEM, Log, & PCAP Retention
We retain all SIEM, log, tagged packet captures (PCAP), session, and ticket data for 12-months for forensics and analysis. Optional optical-disk archives are available for long-term archiving.
Proprietary Signature Updates
We leverage our, proprietary, 13-year old signature database along with our banking signatures and other commercial and community signature databases, updated continuously and customized for your network.
SOC2 Type II Audited
Security is a process not a product. This is why we track everything in our ticketing system (or yours) and annually perform a SOC2 Type II audit of our operations.
SIEM Reports
SIEM reports aggregate the alerts and correlated security data and deliver it to you in an easily understood format with summaries, trending, and visualization that highlight the nature of your network activity. Reports can be prepared daily, weekly, monthly, or yearly.
Firewall Reports
Firewall reports need special attention. Nexgen firewalls provide more data via API that isn't present in logs. We provide daily and monthly reporting for blocked and filtered content, threat detection, geo-activity, and bandwidth graphing.