Security Management & Reporting

Panoptic Cyberdefense Goal: mitigate risk, protect sensitive data, provide visibility to upper management, elevate your security team, all while satisfying compliance requirements.

True threats (high value alerts) need to be separated from your network’s high volume of benign traffic, and require immediate attention. Outsourced Security Management & Reporting, as part of our Panoptic Cyberdefense managed service, offers this peace of mind without the cost or hassle of operating a Security Incident & Event Manager (SIEM).

Accepting security data from all systems in your network into our ELK Stack-based (SIEM) – or yours, if you have one that you can trust ​– we will monitor, correlate, and alert on threats, anomalies, and compliance violations 24/7.

Our SIEM and alerting systems are in our private cloud. We place a log collector on your site or use your existing SIEM if you prefer. In concert with our Panoptic Approach, our SIEM accepts almost any output from Active Directory, firewalls, intrusion detection systems (IDS), data loss prevention (DLP) systems, endpoint detection, and many others.

How onShore Security Management & Reporting Works

customizedsigdetection_small
Security Event & Log Correlation

Correlation of security data is the heart of security management. But we go beyond that with rule customization and data tools that empower the analyst to detect threats, anomalies, and compliance violations.

Elastic-Stack-Mark-Full-Color-300x300_small
onShore ELK Stack-Based SIEM

Receive only truly actionable information and alerts. Our SIEM uses the most advanced analytics available. If you already have a SIEM, we'll manage it for you.

threatlevelalertingicon_small
24/7 Threat-Level Alerting

Our SOC will alert via ticket, API, email, or phone based on custom, agreed-upon criteria. We use the Information Technology Infrastructure Library (ITIL) categories and severity levels.

logsourcesacceptedicon_small
Analyze Log, End-point, SNMP, API Data

We'll customize to accept most any log source. Of course we're ready for your AD, firewalls, IDS, DLP, end-point detection and more. Unlike the others, we also analyze switches (SNMP) for parameters not found in logs.

12-monthSIEMicon_small
SIEM, Log, & PCAP Retention

We retain all SIEM, log, tagged packet captures (PCAP), session, and ticket data for 12-months for forensics and analysis. Optional optical-disk archives are available for long-term archiving.

proprietysignatureupicon_small
Proprietary Signature Updates

We leverage our, proprietary, 13-year old signature database along with our banking signatures and other commercial and community signature databases, updated continuously and customized for your network.

Print
SOC2 Type II Audited

Security is a process not a product. This is why we track everything in our ticketing system (or yours) and annually perform a SOC2 Type II audit of our operations.

networkbehavioranalysisicon
SIEM Reports

SIEM reports aggregate the alerts and correlated security data and deliver it to you in an easily understood format with summaries, trending, and visualization that highlight the nature of your network activity. Reports can be prepared daily, weekly, monthly, or yearly.

managedfirewallicon_small
Firewall Reports

Firewall reports need special attention. Nexgen firewalls provide more data via API that isn't present in logs. We provide daily and monthly reporting for blocked and filtered content, threat detection, geo-activity, and bandwidth graphing.