Managed Firewalls, SIEM & Approved Automated Response
Your Network Perimeter, Managed and Watched
We configure and look after your business firewalls, and their logs are monitored automatically through our SIEM platform. Alerts are reviewed by our team in line with your agreed service level, and approved automated responses act on clear-cut threats.
What is Managed Firewalls, SIEM & Approved Automated Response?
A firewall sits between your business network and the internet and decides which connections are allowed in and out. It only protects you if it is configured properly, kept up to date and watched. Managed Firewalls hands that job to Pulsar IT.
We deploy new firewalls or take over the ones you have. We administer the security policy (the set of rules that decides what traffic is permitted), keep firmware current and make every change through a controlled, documented process, with all your firewalls managed from one place.
Each managed firewall also sends its logs to our SIEM (security information and event management) platform, which analyses them automatically and raises an alert when activity looks suspicious. Alerts are reviewed by our team in line with your agreed service level. Automated responses, such as blocking known malicious traffic, run only where your firewall supports them and you have authorised them.
Key benefits
- One team responsible for your network perimeter, across every site
- Firewall rules reviewed, documented and changed under control
- Firewall logs analysed automatically by our SIEM platform
- Suspicious activity reviewed by our team, with clear next steps
- Monitoring, alert review and approved automated response included in the per-firewall price
How does it work?
Each managed firewall is configured to an agreed policy, managed centrally and connected to our SIEM platform. The SIEM collects and correlates the firewall's logs, applies detection rules and, where applicable, threat intelligence (regularly updated information about known malicious addresses and activity), and raises alerts that our team reviews.
Review and onboard
We review your existing firewalls, rules, firmware and licences, agree the security policy with you, and either take over management or recommend replacing hardware that is unsuitable or out of support.
Configure and connect
We apply the agreed policy, remove risky or unused rules, update firmware, document the configuration and connect the firewall's logs to our SIEM platform.
Monitor and respond
The SIEM analyses the logs automatically. Our team reviews alerts in line with your agreed service level, approved automated responses act on clear-cut threats, and genuine incidents are escalated to your nominated contacts.
Maintain and report
We keep firmware current, handle rule changes through change control, revisit the policy as your business changes and report on what was detected and what was done.
- Firewall logsConnections, blocked traffic, VPN sign-ins and admin changes
- SIEM analysisAutomated correlation and detection rules
- Alert review by our teamIn line with your agreed service level
- Approved response or escalationAutomated block where authorised, or escalation to you
Technical scope
- Firewall deployment, configuration and centralised management
- Security policy administration: inbound and outbound rules, NAT (network address translation) and any services published to the internet
- Rule reviews to find unused, overly broad or undocumented rules
- Firmware updates applied through change control
- Restricted administrative access, with multifactor authentication where the firewall supports it
- Configuration backups and documentation
- Log forwarding from each firewall to our SIEM platform
- Automated analysis of firewall logs using detection rules
- Threat intelligence integration where applicable, depending on your firewall and its licences
- Alert review by our team in line with your agreed service level
- Approved automated response, such as blocking a known malicious address, where supported and authorised
- Escalation of genuine incidents to your nominated contacts
- Regular reporting on security events and configuration changes
What monitoring can pick up
Repeated VPN sign-in failures
Many failed remote access attempts against one account, or from unusual locations, can point to password guessing. The alert is reviewed and, where you have authorised it, the source can be blocked.
Contact with a known malicious address
A device inside your network connecting to an address flagged by threat intelligence may be infected. The connection can be blocked under an approved policy and the device checked.
An unexpected configuration change
An administrative change made outside the agreed change process is flagged, so it can be checked against what was actually authorised.
Probing of an exposed service
Internet scanning of your public addresses is routine background noise, but a change in pattern, or repeated attempts on a published service, is worth a closer look.
Problems solved
A firewall installed and forgotten
Rules and firmware drift out of date after installation. Ongoing management keeps the configuration effective as threats and your business change.
Nobody reads the logs
Firewalls record useful warning signs, but only if someone looks. Our SIEM platform analyses the logs automatically and raises alerts for review.
Rules nobody can explain
Ports opened temporarily for a supplier and left open are a common gap. Rule reviews and documentation find and remove them.
Slow reaction to obvious threats
Waiting for a person to block a known malicious address wastes time. Approved automated responses can act straight away where your firewall supports them.
Different settings at every site
Firewalls managed separately drift apart. Central management keeps policies consistent across your locations.
What's included
Included as standard
- Firewall configuration, rule management and firmware updates
- Security policy administration with change control and documentation
- Automated monitoring of firewall logs through our SIEM platform
- Review of security alerts by our team, in line with your agreed service level
- Approved automated response, where supported by your firewall and authorised by you
- Escalation of genuine incidents to your nominated contacts
- Regular reporting on security events and changes
Optional or scoped
Available on request and confirmed in your proposal; not part of the standard service.
- Always-on VPN for remote staff, through Secure Remote Working
- Network segmentation, through Secure Your Network
- A one-off firewall rulebase and configuration assessment
- Firewall replacement or new installation projects
- SIEM monitoring of laptops and desktops, through Managed Endpoint Security
What's not included
- Firewall hardware, security licences and vendor subscriptions, unless agreed in your proposal
- 24/7 SOC analyst investigation of firewall alerts; alerts are reviewed by our team in line with your agreed service level (24/7 analyst coverage is available for subscribed services through Pulsar IT Managed SOC)
- Full incident investigation and recovery beyond initial response and escalation, which is scoped separately
- Monitoring of laptops, servers and cloud services, which are covered by other services
- Internet line faults, which remain with your connectivity provider unless we supply your connection
Firewall monitoring is automated and alerts are reviewed by our team in line with your agreed service level. 24/7 SOC analyst coverage applies only to endpoints and services onboarded to Pulsar IT Managed SOC, and does not include firewalls.
Automated responses depend on your firewall's features and licences and run only under policies you have authorised. Older or unsupported firewalls may need replacing before they can be monitored or respond automatically.
A firewall protects the edge of your network. It does not replace endpoint protection, patching, email security or staff awareness.
Who it's suitable for
- Businesses with one or more office firewalls and nobody to manage them
- Organisations whose firewall was installed years ago and not reviewed since
- Multi-site businesses that want consistent policies across locations
- Companies that want firewall logs watched without building their own monitoring
- Businesses preparing for Cyber Essentials, where firewall configuration is one of the controls
Pricing
Managed Firewalls are priced per firewall per month. Automated SIEM monitoring of the firewall's logs, alert review by our team and approved automated response are part of that price, not charged separately.
Use the quote builder to add Managed Firewalls, SIEM & Approved Automated Response to an indicative quote, or book a free security review and we'll recommend what fits.
Price
£95 per firewall / month
Includes automated SIEM monitoring, alert review and approved automated response, not charged separately. Firewall hardware, licences and subscriptions are extra unless agreed in your proposal.
What affects the price
- Number of firewalls
- Number of sites
- Whether your current firewalls are suitable and still supported
- Firewall security licences and subscriptions
- Remote access requirements
- Any initial clean-up or replacement work
All prices exclude VAT.
Add to Your QuoteFrequently asked questions
Is SIEM monitoring charged on top of the firewall price?
No. Automated SIEM monitoring of the firewall's logs, alert review and approved automated response are included in £95 per firewall per month. Firewall hardware and licences are separate unless agreed in your proposal.
Are firewall alerts investigated 24/7?
Not as part of this service. Our SIEM platform analyses firewall logs continuously, and people review alerts in line with your agreed service level. Outside those times, approved automated responses can still act on clear-cut threats where your firewall supports them. 24/7 SOC analyst investigation is available for covered devices and subscribed services through Pulsar IT Managed SOC, and we can discuss whether firewall logs should be added as a Managed SIEM source.
What does approved automated response actually do?
It lets pre-agreed actions run without waiting for a person, for example blocking a known malicious address at the firewall. We agree with you which actions are allowed, and nothing runs automatically unless your firewall supports it and you have authorised the policy.
Can you manage the firewall we already have?
Often, yes. We check its model, support status, firmware and licences first. If it is past its end-of-support date or can't send logs for monitoring, we'll explain the options, including replacement.
How is this different from a firewall assessment?
A firewall rulebase and configuration assessment is a one-off review with recommendations. Managed Firewalls is ongoing: we make the changes, keep the firewall updated and monitor its logs every month.
Who is told if something serious happens?
We agree a list of nominated contacts during onboarding. Genuine incidents are escalated to them with what we found, anything already done automatically and the recommended next steps.
Let's Secure Your Business
Find out how Pulsar IT can help protect, manage and improve your IT environment.