Next-Generation SIEM

Next-Generation
SIEM

As a Service

What’s a Next-Generation SIEM?

New generation of SIEM platforms bolsters top-down monitoring of network and cloud-application activity with applied analytics techniques that help spot security incidents as soon as they’re happening. Those new techniques have emerged as the maturation of security analytics techniques, and the collection of increasingly large and varied types of activity data, enable SIEM vendors to apply new methodologies to the analysis of corporate data. This, in turn, better equips Managed Security Service Providers (MSSP’s) such as Custodian as well as end-user organizations to identify anomalous behaviour – and act on it – as soon as it is happening.

One of the most significant inputs into the system is increasingly being referred to as User and Entity Behaviour Analytics (UEBA) behaviour – and it’s proving to be indispensable in quickly identifying malicious activity before it leads to the theft of sensitive data from corporate networks or servers.

Protect your organization against cyber security breaches

Custodian’s Next-Generation Security Information and Event Management (SIEM) platform helps to quickly and adequately find cyber security related events that require immediate attention. By correlating log-files and event information from multiple sources, such as routers, switches, firewalls, IPS / IDS, (file and database) servers, endpoints and antivirus systems at user level and behaviour (UEBA), our Next-Generation SIEM platform detects security risks which otherwise wouldn’t have been discovered by traditional stand-alone security solutions.

Simplify SIEM deployment

With cyber security expertise at a premium, let our specialists implement and manage a cloud-based Next-Generation SIEM solution for you. We’ll monitor millions of logs on your behalf, only getting in touch when an important incident occurs, then offering remediation advice. Not only will you get the protection you need, this will also leave your own administrators free to prioritize other strategic projects.

Access to security experts

SIEM as a Service guarantees expert guidance and advice to help contextualize and eliminate alerts and unusual events. Specialists from our team can also ensure that your SIEM platform remains up-to-date and correctly configured to your evolving environment, so time spent investigating false alarms is reduced.

The 9 major benefits of a Next-Gen SIEM as a Service

1. We go way beyond Legacy Security Monitoring

Traditional perimeter-based security solutions focus on finding threats that come from outside your organization. According to the 2019 Verizon Data Breach Investigations Report, one out of every three identified breaches involve an internal actor. Whether this is an insider with malicious intent, an insider whose credentials have been compromised, or even an insider that acted unwisely, the organization is still breached. Custodian’s SIEM as a Service platform consists of a very advanced User and Entity Behaviour Analytics (UEBA) tool which leverages sophisticated machine learning and behaviour analytics to analyse and correlate interactions between users, systems, applications, IP addresses, and data. This UEBA tool detects advanced insider threats, cyber threats, fraud, cloud data compromise and non-compliance. It has built-in automated response play books and customizable case management work flows which allows our security team to respond to threats quicker, more accurate and more efficient than making use of more traditional Security Monitoring solutions.

2. CapEx vs. OpEx

The more money put towards capital expenditures (CapEx) will result in less free cash flow for the rest of the Operating Expenses (OpEx), which can hinder short-term operations.

3. A lower TCO

SIEM as a Service will result in a lower Total Cost of Ownership (TCO) by eliminating the need to purchase and maintain on-premises technology and to recruit, hire, train and retain an in-house security capability.

4. We store our data within the EU!

Data protection is a top priority at Custodian as you may expect. For that reason, we keep your data safe and secure in an A-class Data Centre in Germany which is by far one of the most stringent and safe countries in the world with regards to data Privacy, data Security and data Governance. As a consequence of the GDPR (Bundesdatenschutzgesetz: BDSG) and some other specific German data laws, our customers, who entrust us with some of their most sensitive information, can control where and how their content is stored and who has access to it.

5. Saving up to 50% of your SIEM vendor’s license costs!

Every log and every security event matter. Not retaining your log data can create security blinds spots that prevent compliance or leave your organization vulnerable to attack. However, there is an immense amount of log files which doesn’t contain security related information. For this specific reason, Custodian has developed its Intelligent Data Assessment and Storage System (IDASS). Our IDASS is designed to intelligently split and route the relevant log files and event information from the irrelevant ones in a superfast and robust way. IDASS makes use of Greylog and Hadoop which are both Open Source software solutions and both leaders in their own segment. By making use of our IDASS system we can reduce the SIEM vendor’s license costs up to 50% whilst still complying to all GRC requirements.

Custodian’s IDASS is designed to scale unlimitedly without complexity. Simply add nodes/ sources to provide additional storage and processing power. Our economic scaled pricing model is based on the number of users in your organization. Custodian’s IDASS delivers incredible cost efficiency through unlimited ingestion and storage at very reasonable pricing since we make use commodity hardware making it much more cost efficient compared to traditional legacy log management products.

6. Freeing up internal resources

Freeing internal resources to focus on core organizational competencies while our team of experts takes care of your cybersecurity-related challenges.

7. Compliance and insight

You won’t only be able to detect and respond to threats quickly and effectively, but you’ll also be able to prove your compliance with relevant regulatory demands for logging and monitoring. And so, you can take steps to improve your security posture further still, we’ll provide access to a secure, tailored dashboard. It illustrates all the information we’re gathering and offers timely incident reports. Custodian provides client specific reports that are required to demonstrate compliance. Investments in security measures such as IDS, IPS or anti-DDoS are made measurable and justified.

8. Optimized Security spending

You won’t have to invest time and money in acquiring experienced security resources and providing them on-going training which is required. So, this approach to SIEM can lower your overheads considerably. Furthermore, you can align our solution to your specific needs, making this element of security an affordable, predictable expense.

9. Wide range of Use Cases

Custodian has a wide range of relevant and proven Use Cases available like the examples below, but there are many more: