SIEM and IT security on Elastic Security
We implement and run a SIEM on Elastic Security. We collect logs from across your environment, detect suspicious events, link them into incidents, send alerts and automate the response. Relipoint is an official Elastic partner, and our team holds accreditations in Security.
What security teams bring to us
-
Nobody reads the security logs
Events from firewalls, servers and the cloud sit apart. A SIEM collects them together and flags the ones that need a response.
-
Too many alarms, too little time
The team drowns in notifications and ignores the important ones too. Correlation and well-chosen rules cut the noise down to events worth your attention.
-
Incident response takes too long
Every incident needs the same manual steps. Automation (SOAR) carries out repeatable actions, such as blocking a suspicious IP address.
-
An audit needs evidence
You have to show what happened, when and who responded. A SIEM retains events and generates compliance reports.
A SIEM makes sense when someone takes over what it detects. So an implementation covers more than the platform: it also covers rules, alerts and agreeing who responds to events and how.
A SIEM rests on well-collected logs, so we often start by centralising them. We launch the platform as an Elastic implementation and show the results on dashboards.
How we price
We set the price after getting to know your environment. It depends on the number of log sources and protected endpoints, data volume, retention time, the scope of rules and automation, the deployment model, and the scope of maintenance and on-call cover.
What we do
- We collect security logs from servers, workstations, network devices, applications and clouds
- We implement Elastic Security as a SIEM, together with threat detection rules
- We correlate events from many sources to detect complex attacks
- We set up alerts and their escalation to the right people
- We automate incident response (SOAR), for example blocking suspicious IP addresses
- We deploy endpoint protection for workstations and servers (EDR) in Elastic Security
- We prepare security and compliance reports
- We maintain the platform, tune the rules and provide on-call cover as set out in the contract
Who it is for
- You need a SIEM and want to build it on Elastic Stack
- You have security logs, but nobody analyses them
- You must demonstrate compliance with audit or regulatory requirements
- Your current SIEM is too expensive or too elaborate
Detection and correlation
Detection rules look for suspicious activity, such as intrusion attempts or brute-force attacks. Correlation links events from different sources, because a single log rarely suffices to recognise an attack.
- Threat detection rules in Elastic Security
- Correlation of events from servers, networks and clouds
- Alerts escalated to the people responsible
Response, EDR and automation
Once a threat is detected, time matters. Endpoint protection (EDR) gathers data from workstations and servers, and SOAR automation carries out repeatable steps, such as blocking a suspicious IP address.
- EDR on workstations and servers
- Response automation (SOAR)
- Incident analysis data collected together
Reports and compliance
We prepare reports that show the state of security and events over a given period. They help with audits and with conversations with management and customers.
- Incident and trend reports
- Data for audits and inspections
How we work
- 1
Environment review
We establish log sources, security requirements and existing tools.
- 2
Architecture
We choose the Elastic deployment model, retention and the scope of rules.
- 3
Implementation
We start data collection, detection rules, alerts and automation.
- 4
Tuning
We review alerts from the first weeks and reduce false alarms.
- 5
Maintenance and on-call
We maintain the platform and respond to events within the scope agreed in the contract.
Experience
- Relipoint is an official Elastic partner, and our team holds Elastic accreditations in Security (Sales Specialist and Sales Engineer).
Frequently asked questions
What is a SIEM?
A SIEM is a system that collects logs from across your environment, correlates them and raises an alarm about events that point to an attack. The name stands for security information and event management.
Does a SIEM replace antivirus or a firewall?
No. A SIEM does not block traffic by itself. It analyses events from your other security tools and points out what needs a response. Together with EDR it can also act on workstations and servers.
Do you respond to alerts around the clock?
We agree the scope of on-call cover and response hours in the contract, depending on what you need.
Do you deliver together with Conetso Group?
Yes. We deliver Elastic SIEM implementations together with Conetso Group, which also handles infrastructure security such as firewalls and endpoint protection.
See also
-
Log management in Elasticsearch and Kibana
Logs from applications, clouds, networks, virtual machines and hypervisors on one platform: collection, search, retention and alerts.
-
Elastic Stack implementation: licences, deployment and support
Official Elastic partner: licences, implementation, cluster cost and performance optimisation, maintenance and on-call.
-
IT infrastructure monitoring on Elastic
Servers, networks, server rooms, hardware and clouds in one monitoring system: data, dashboards and alerts on Elastic Stack.
-
Conetso Group
Cybersecurity at Conetso Group
Firewalls, endpoint protection, Microsoft 365 security and SIEM delivered together with Relipoint.
