网络安全

SOC 与 SIEM 安全监控

防火墙、服务器和终端日志汇入同一 SIEM，有专人盯告警，出事时有清晰的处置预案。

现场常见问题

Most attacks leave traces in the logs for days or weeks before the damage. But those logs are spread across devices, overwritten automatically, and nobody reads them. By the time anyone notices, the files are encrypted and there's no evidence of how the attacker got in.

A SIEM (security information & event management) platform pulls logs from firewalls, Active Directory, servers, EDR, email and cloud (Microsoft 365/Google) into one place and runs correlation rules to find what doesn't look right. For example: 40 failed logins followed by a success, a Vientiane employee's account signing in from abroad at 3 a.m., or a new admin account nobody remembers creating.

SOC: people, process and tools

A SIEM nobody watches is an expensive log bucket. A SOC (security operations center) is the team that triages alerts, investigates and responds by playbook. Three options:

In-house SOC: full control, but 24/7 staffing. In our experience it takes at least five or six people to cover every shift.
Managed SOC: our team, working with partners, watches the alerts and calls you when action is needed.
Hybrid: your team covers business hours, we cover nights, weekends and holidays.

For most organizations in Laos we recommend hybrid. Your IT team knows your systems best, but attacks tend to land at night and over long holidays.

What you get besides alerts

Complete, searchable logs answer the questions that matter after an incident: when they got in, how, and what they touched. Monthly and annual summaries show management the real security picture and give them something to budget against.

功能

Logs in one place

Firewall, AD, servers, EDR, email and cloud.

Detection rules

Mapped to MITRE ATT&CK and tuned to your environment.

Response playbooks

Ransomware, hijacked accounts, data leaks: who does what, in what order.

Enough retention

The evidence is still there when you need to look back.

Dashboards and reports

Monthly and annual summaries for management.

24/7 coverage

Hybrid, or fully managed by us.

设计与实施

1
Pick the critical log sources and what you want to catch
2
Deploy the SIEM (on-prem or cloud) and size storage
3
Onboard log sources and check nothing is missing
4
Build rules, dashboards and playbooks
5
Cut false positives; agree who handles what and how to escalate
6
Run a tabletop exercise once a year

适用场景

Banks and financial institutions that need full visibility and evidence
Companies running online services for many customers
Energy and utility companies
Groups with several businesses wanting one security view

常见系统规模

Log Foundation

适用于: Starting point: collect and search logs

SIEM or log platform
Firewall, AD and key servers connected
Baseline alerts

获取报价

Hybrid SOC

适用于: Organizations with in-house IT

MITRE ATT&CK-based use cases
Playbooks and team training
We cover nights, weekends and holidays

获取报价

Managed 24/7

适用于: No in-house monitoring team

24/7 monitoring by our team with partners
Response and immediate notification
Monthly service review

获取报价

我们供货并安装的品牌

Microsoft Fortinet Palo Alto Networks CrowdStrike Trend Micro Sophos Check Point

所有品牌名称和商标归其各自所有者所有。除非另有明确说明，提及某品牌并不代表与其存在合作关系。产品均通过正规分销渠道采购。

常见问题

How does SIEM differ from EDR?

EDR looks deep inside each machine. SIEM looks wide, combining every source including EDR, to see attacks that move across systems. Many organizations start with EDR and add a SIEM later.

How long should we keep logs?

Intrusions are often found weeks after they start. We suggest at least 90 days instantly searchable and a year or more in archive. Some industries have their own requirements.

Is it worth it for a mid-size organization?

Start with the log foundation package or a pay-per-volume cloud SIEM to keep costs in check. Once you see the value, add 24/7 monitoring.