Table of Contents

    About the Author

    Jon Matthews

    Jon Matthews

    Jon Matthews is a highly experienced and trusted leader in computer and network forensics with over twelve years of experience. He leads investigations around high-profile digital forensic and incident response matters helping clients determine the root cause and extent of breaches. Jon retired from the U.S. Army with over 20 years of service. He was a Special Agent with U.S. Army Counterintelligence for nine years and specialized in digital forensics for espionage and APT investigations. Jon also worked with Aon's Cyber Solutions (Stroz Friedberg) leading their Washington, DC forensic lab and conducting digital forensic and incident response investigations for two and a half years. Education, Certifications, and Training: Jon holds a Bachelor of Science degree in Computer Networks Security from the University of Maryland University College, and holds a Graduate Certificate in Incident Response from the SANS Technology Institute. Jon was a certified Computer Crime Investigator while working in the U.S. Army. His certifications include being a CISSP, Certified Incident Handler, Certified Forensic Analyst, Network Forensic Analyst, Reverse Engineering Malware, Advanced Smartphone Forensics, Certified Ethical Hacker, Secure Infrastructure Specialist, A +, Network +, and Security +.

    More Articles

    Additional Resources:

    CrowdStrike, SentinelOne, and MS Defender: The EDR Trio Powering CyberMaxx’s Advanced Threat Detection

    CrowdStrike, SentinelOne, and MS Defender: The EDR Trio Powering CyberMaxx’s Advanced Threat Detection

    Articles

    5 min read

    Behind the Alert: How EDR Use Behavioral Data to Detect Threats

    Behind the Alert: How EDR Use Behavioral Data to Detect Threats

    Articles

    6 min read

    The cloud has become the primary environment that businesses use to store and manage data.

    According to a recent study, 57% of enterprises already have a central cloud team with another 24% planning one. Because of this shift, security information and event management (SIEM) has become a common security control and it’s essential to start protecting your cloud environment with managed SIEM services. At its core, SIEM is a log-monitoring technology that helps businesses get a comprehensive perspective on threats that exist on their various cloud-based systems. Cloud-managed SIEM is the primary way businesses discover probes and breaches. It also ensures compliance with regulatory standards like PCI and HIPAA that require log monitoring and retention.

    How does SIEM help with protecting your cloud environment?

    At CyberMaxx, our MAXX SIEM service is designed to protect your cloud environment against potential threats by monitoring, reviewing, and translating data into actionable insights through four key steps.

    Step 1: SIEM Aggregates Your Information

    SIEM aggregates logs into a central location. Every day your servers, firewalls, routers, and applications generate millions of lines of logs. The first thing SIEM does is aggregate all of that information into one centralized location, to start the process of protecting your cloud environment with SIEM.

    Step 2: SIEM Processes and Normalizes Logs into a Standard Format

    One of the challenges of protecting your cloud environment is the multiple log formats you receive from various sources, making it incredibly difficult to analyze potential threats. A SIEM system gathers all logs from various sources and normalizes the data into a single, standard format that can be efficiently analyzed.

    Step 3: SIEM Correlates and Enriches All Logs to Bring Data to Life

    When evaluated individually, most log entries do not contain enough context to be useful. Correlation is what helps translate raw data and information into the actionable insights you need to protect your cloud-based data. The picture is clear when log data is correlated from servers, firewalls, applications, and asset databases.

    Step 4: SIEM Analyzes and Identifies Potential Threats Specific to Your Organization

    We can then show you how to start protecting your cloud environment. Once all log data is collected and contextualized, SIEM goes to work to identify the greatest potential threats. What makes SIEM so valuable is the endless number of threats that can be monitored. For example, you can set up an alert as detailed as “when someone logs into the accounting server between midnight and 5 a.m.”

    MAXX SIEM can discover potential issues and is ideal for protecting your cloud environment of today’s security systems simply cannot detect. Investing in advanced security systems now will significantly lower your chance of experiencing a security issue, while also giving you the peace of mind in knowing that all of your security systems are in sync, monitored, and functioning properly.