Celero will assist in onboarding of devices into the SIEM solution to ensure that maximum security visibility is achieved. This includes reviewing the appropriate set of servers, applications, infrastructure and security controls to send logs to the SIEM solution. This review will also include the desired logging levels and events to be analyzed.

Celero’s Managed Security Services will ensure that the SIEM solution has an effective initial policy to identify suspicious and malicious behaviour. This policy tuning and alert monitoring setup takes place during onboarding and is ongoing. We review, setup and configure use-cases that focus on foundational security monitoring and response. Enables 24/7/365 security detection, qualification and remediation support.

We continuously monitor the SIEM solution to identify suspicious and malicious behaviour from device logs. Our dynamic alerting is based on new and relevant security threats, pattern-based activity, and defined use cases to detect inappropriate behaviour. All alerts are qualified and triaged by advanced security operations centre personnel and actioned appropriately based on severity levels.

Celero will continuously monitor core security assets on a 24/7/365 basis. Once an alert is detected, our security analysts will qualify the event, and provide support to contain, eradicate, and recover from the cyber security attack. Celero may offer additional services to perform recovery services such as rebuilding of servers and laptops.

As security threats continue to evolve, so too does your SIEM policy and detection engine. We continuously tunes the SIEM platform to identify new attack patterns and identify suspicious and malicious behaviour.

On a monthly basis Celero will provide detailed technical reporting. These reports contain valuable information on technical threats and can often reveal common trends and security areas for improvement.