Cybersecurity & Secure Access
Security Monitoring & Logging
Centralised logs with real retention and alerting, so an investigation has evidence rather than devices that overwrote the period in question.
Most organisations discover an intrusion long after it began, and then find that the evidence needed to understand it no longer exists. Firewalls, switches and endpoints keep small local buffers that roll over in days, so by the time anyone looks, the earliest and most informative part of the timeline has gone.
Centralised logging fixes that cheaply. Shipping logs off devices to storage with a defined retention period turns an investigation from guesswork into analysis, and it is a prerequisite for every framework worth measuring against, including the NCA's ECC.
Alerting is the harder half, because a monitoring system that fires constantly is ignored within a fortnight. The useful approach is narrow and specific to begin with — impossible logins, privilege changes, mass file access, a camera segment suddenly talking to the internet — and broadened as each alert proves itself worth acting on.
What this covers
Central log collection
Logs shipped from firewalls, switches, servers, endpoints and security appliances to storage with a stated retention period.
Correlation and alerting
Rules that combine events across sources, so a pattern is recognised even when no single event is remarkable.
Time synchronisation
One time source across the estate, without which correlating two systems' logs is guesswork.
Retention for investigation
Enough history to reconstruct an incident that started months earlier, which is the normal case rather than the exception.
Reporting for compliance
Evidence that controls are operating, produced from the logs rather than assembled by hand before an audit.
What we will ask you
These are the questions that decide the specification. Having the answers ready is what turns a first conversation into a real quotation.
- 01
How long is long enough?
Dwell time before discovery is commonly measured in months. Retention shorter than that means the beginning of the incident is unavailable.
- 02
Who reads the alerts?
Monitoring with no staffed response is a log with extra steps. Decide whether it is watched in-house or by a provider.
- 03
Is everything on one clock?
Without NTP across the estate, cross-referencing two systems is unreliable and any timeline is contestable.