Cyber Security Services
Centralized Log Monitoring & SIEM Rollout for a Growing SaaS Team
Set up centralized log aggregation and a lightweight SIEM so the team could detect suspicious activity instead of relying on scattered, unreviewed server logs.
01
The Challenge
Application and infrastructure logs were scattered across individual servers with no retention policy and nobody reviewing them, meaning suspicious activity would only be discovered after the fact, if at all.
02
The Approach
1
Deployed an ELK-stack-based log pipeline (Elasticsearch, Logstash, Kibana) to centralize application, server, and firewall logs.
2
Configured Wazuh as a lightweight SIEM layer for rule-based alerting on suspicious patterns — repeated failed logins, privilege escalation attempts, unusual outbound traffic.
3
Built alert routing to Slack for high-severity events, with a documented escalation path.
4
Set log retention policies to satisfy the client's compliance and incident-investigation needs.
03
The Outcome
The team went from no visibility into suspicious activity to real-time alerting on common attack patterns, catching a credential-stuffing attempt against the login endpoint within its first month in production.
© Copyright 2024
Ajish
Stephen