REAL TIME THREAT MONITORING (RTTM)

Take a proactive approach to threat monitoring

Collecting and analysing security logs is a critical component of a security strategy and should be made a mandatory practice. However, millions of individual log entries can be generated daily and the task of organizing this information can be overwhelming. Too often, the burden is placed on internal teams to monitor systems 24/7, which causes organizations to have gaps in their detection or not to monitor logs at all.

Without real time security monitoring, IT and security teams have no visibility of the current and proposed threats to their infrastructure and data assets. The Real-Time Threat Monitoring (RTTM) services from SYSIT meets the toughest security requirements that organisations require.

SYSIT’s process includes:

Log Collection SYSIT collects logs from all relevant IT infrastructure sources. The log collection will be performed via SIEM system agents, and imported securely and is compressed at the indexers.

Log Analysis

SYSIT analyses the collected data against pre-defined set of best practice use cases and specific use cases agreed with the customer.

Incident Notification SYSIT develops an incident notification process, taking into consideration the customers environment and notify the customer based on the incident classification of each incident.

Log Management

Includes Lifecycle management of collected logs. Our guidelines on log managements were designed based on PCI-DSS recommendations. All logs collected are retained for a set period depending on the customer policies and practices. SYSIT provides flexibility for customers to increase the retention period to meet their specific requirements at an additional cost.

Incident Classification In this manual process performed by SYSIT’s Cyber Defense Centre team, each incident is validation and classified.

Incident Management and Detailed Report SYSIT manages the incident response process to a successful conclusion. This includes incident tracking, incident containment (advise) and incident remediation advise. eHDF also prepares a detailed report after the incident is concluded to ensure continuous improvement.

24/7 threat monitoring and resolution for protection against breaches

Security breaches unfortunately happen all the time. While larger companies can weather the financial and PR storms associated with a breach, small businesses on average close their doors within 6 months of an incident. What’s worse is that post-attack analyses show a vast majority of breaches are active within the network for months – even years – before detection; the only thing missing in these cases was a security expert looking for the evidence of a compromise.

 

IT’S TIME TO GET ACQUAINTED WITH BUSINESS SECURITY.

THREAT INTELLIGENCE: Detailed analysis of security alerts are initiated within a 24x7x365 Security Operations.

REAL-TIME LOG COLLECTION: Logs and events are collected and transmitted to the cloud in real-time for automated correlation.

ACCURATE DETECTION: Security rules identify suspicious irregularities by evaluating millions of network events.

HUMAN EXPERTISE: Every security event identified by the cyber-threat detection engine is evaluated by a trained expert.

SECURITY RESPONSE: Threat mitigation and remediation procedures are provided to ensure business continuity.

STATUS REPORTING: Executive-level and in-depth technical reports provide a granular view of active network threats.