What Are SIEM, SOAR and Managed Security Monitoring?

Every device and service in your business produces records of what is happening: sign-ins, blocked connections, software installs, configuration changes. Hidden in those records are the early signs of an attack. The challenge is spotting them among millions of routine events, and acting quickly when it matters. That is the job SIEM, SOAR and managed security monitoring are designed to do.

What is a SIEM?

SIEM stands for security information and event management. A SIEM platform:

• collects logs and events from firewalls, servers, laptops, Microsoft 365 and other cloud services
• normalises and correlates them, so related events from different systems can be seen together
• detects suspicious patterns using rules and threat intelligence, for example repeated failed sign-ins followed by a success from an unusual location, or traffic to a known malicious address
• alerts when something needs attention
• keeps a searchable history, so incidents can be investigated after the event

A SIEM is only as good as the data it receives and the rules it runs. Badly tuned, it produces so many alerts that the important ones are missed.

What is SOAR?

SOAR stands for security orchestration, automation and response. Where a SIEM tells you something is wrong, SOAR helps do something about it, using playbooks: predefined steps that run automatically or with one click. Typical actions include:

• blocking a malicious IP address or domain at the firewall
• isolating a compromised device from the network
• disabling a user account or forcing a password reset
• gathering extra information to speed up investigation

Automation is fast and works out of hours. But a playbook that blocks the wrong thing can disrupt the business, so automated actions should be limited to clear, pre-agreed cases.

How they fit with EDR, MDR and a SOC

• EDR (endpoint detection and response) watches what happens on each laptop, desktop and server, and can stop malicious behaviour there. It is often one of the most valuable sources of data for a SIEM.
• A SOC (security operations centre) is a team of analysts who monitor and respond to alerts. Some operate 24 hours a day; many do not.
• MDR (managed detection and response) is a service that combines detection technology with people who investigate and respond for you.

These terms overlap, and providers use them differently. What matters is what is actually monitored, by whom and when.

What does managed security monitoring involve?

Running a SIEM yourself means choosing data sources, writing and tuning detection rules, reviewing alerts and keeping it all up to date, which is a specialist job. With managed security monitoring, a provider does this for you. A good service will:

• connect the right sources, typically firewalls, endpoints and Microsoft 365
• tune detections to your environment to keep false alarms down
• review alerts that need human judgement and escalate genuine issues to you
• run approved automated responses for clear-cut threats
• report regularly on what was detected and what was done

Why it matters for small businesses

Attackers often act outside office hours, and the gap between a first foothold and real damage can be short. Without monitoring, the first sign of an attack may be encrypted files or a customer reporting a suspicious invoice. Logs also matter afterwards: they show what happened, which accounts and data were affected, and whether you need to report a breach to the ICO. Monitoring works best alongside the basics in our guides to network security and Microsoft 365 security.

Questions to ask a provider

1. Which systems are monitored: firewalls, endpoints, servers, Microsoft 365?
2. Which parts are automated, and when do people review alerts? Is human review available 24/7, or during set hours?
3. Which automated actions can run without asking you first, and who approves them?
4. How quickly will you be told about a confirmed incident, and how?
5. How long are logs kept, and can you get access to them?
6. What does the service not cover, and what does incident response beyond the first steps cost?

How Pulsar IT approaches security monitoring

We want you to know exactly what you get. Our security monitoring is automated: logs are collected and analysed continuously by our SIEM platform. Alerts that need a decision are reviewed by our team in line with your agreed service level. This standard monitoring is not 24/7 analyst coverage: for that, Pulsar IT Managed SOC adds investigation by specialist SOC analysts, around the clock, for the devices and services you subscribe. Automated responses, such as blocking known malicious traffic, run only where your products support them and under policies you have authorised.

• Managed firewalls (£95 per firewall per month) include automated SIEM monitoring of firewall logs, alert review and approved automated response, with no separate charge.
• Managed Endpoint Security, CVE Remediation & SIEM (£10 per device per month) adds vulnerability remediation, SIEM monitoring of your endpoints, human review of alerts and approved automated response.

Prices exclude VAT and are confirmed after a short scoping review. Find out more about our managed firewall & SIEM, managed endpoint security and security monitoring services and our approach to security, or build a quote.