Skip to content

Consulting · Managed SIEM

Managed SIEM and security data lake

A turnkey SIEM platform based on Elastic, run by experienced security engineers: up to date, hardened and scalable. Your team focuses on detection.

Book a callManaged SIEM or ACDC?

Security data lake

Last 18 months

Search203.0.113.47412 hits in 4 sources

  1. 3 days ago · Windows Event 4624, remote logon
  2. 6 weeks ago · Microsoft 365 Sign-in from a new country
  3. 7 months ago · Firewall Connection blocked, port 3389
  4. 14 months ago · VPN Failed sign-in, account ext.adminEarliest trace
Retention per source as you specifyIllustration with sample data · Time axis not to scale

Overview

What is a managed SIEM?

Managed SIEM is a service in which snapSEC GmbH from Vorchdorf runs a SIEM platform based on Elastic for companies in Austria, Germany and Switzerland. We take care of setup, updates, patches, platform monitoring and hardening, and keep logs from any source in a security data lake for anything from days to several years. Your team keeps control of rules, alerts and use cases.

What you get

  • A running, hardened SIEM instance based on Elastic
  • Retention per source as you specify, from days to years
  • Access to Elastic's prebuilt integrations and detection rules
  • A quarterly maintenance session with a security consultant
  • An optional SLA for the platform

At a glance

Managed SIEM
Service
Operation, maintenance and hardening of your SIEM instance based on Elastic
Data sources
Any log source, whatever the volume; according to Elastic, more than 300 prebuilt integrations
Retention
Set individually, from days to several years
Detection
According to Elastic, around 2,000 prebuilt detection rules; your team creates its own rules and alerts
Support
Quarterly maintenance session with a security consultant (about 2 hours), optional SLA for the platform
Suited to
Companies with their own IT or security team that want a SIEM without the infrastructure work

Scope

What snapSEC takes on

We focus on platform stability, security best practice and scalability. Your team keeps control of content and use cases.

Operation

Platform operation and security

We run and maintain your SIEM instance based on Elastic so that it stays up to date, stable and hardened.

  • Setup, operation and maintenance of the Elastic SIEM instance
  • Regular updates and patch management
  • Platform monitoring: health status, components, storage
  • Hardening to best practice plus tailored optimisation
  • Adjustable retention from days to several years

Service

Managed service and SLA options

snapSEC manages the entire platform. Your team carries no administration burden.

  • Optionally with defined SLAs, e.g. for platform availability and response times
  • Quarterly maintenance session with a security consultant (approx. 2 h)
  • Extendable with additional consulting where needed

Content

Integrations and rules in your hands

You connect what you need and decide which rules apply and when to raise an alert.

  • According to Elastic, more than 300 prebuilt integrations for common vendors and tools
  • Ingestion of any log source, whatever the volume
  • According to Elastic, around 2,000 detection rules to enable and adapt
  • Your team creates its own rules and configures alerts

Figures for integrations and detection rules are Elastic's own; the scope depends on the version in use. Elastic and Elasticsearch are trademarks of Elasticsearch B.V.

How it works

From log line to detection

snapSEC runs the platform in the middle. You decide which sources are connected, how long data is kept and which rules apply.

Diagram: log sources flow through ingest pipelines into a data lake with hot, warm and cold tiers, where they are available for search, detection rules, alerts and threat hunting. snapSEC runs the platform; your team owns sources and rules.

  1. Sources

    • Firewall and VPN
    • Microsoft 365 and Entra ID
    • Windows and Active Directory
    • Linux and syslog
    • Endpoint and EDR
    • Cloud and SaaS

    The examples on the map and any other source

    and any other source

    According to Elastic, 300+ prebuilt integrations

  2. Ingest

    • Collect
    • Parse and normalise
    • Enrich

  3. Data lake

    Hot
    Recent data, fastest search
    Warm
    Older data, still searchable
    Cold
    Long-term retention

    Retention as you specify, from days to several years; storage tiers shown schematically

  4. Use

    • Search and forensics
    • Detection rules
    • Alerts and dashboards
    • Threat hunting

    Alerts to your team or to ACDC (24/7)

    According to Elastic, around 2,000 prebuilt rules

Who does what?

  • Your choiceWhich sources are connected
  • Run by snapSECSetup, updates and patches, health monitoring, hardening; retention as you specify. Optional SLA.
  • Your teamRules, alerts and response, optionally with ACDC around the clock

Run by snapSEC Stays with you

Security data lake

All logs in one place, searchable for years

A SIEM detects what is happening now. A data lake answers what happened months ago: every log source lands in one platform, consistently processed and kept for the long term.

  • Forensics

    Reconstruct when and where an attacker got in.

  • Compliance

    Keep logs available for audits and evidence.

  • Threat hunting

    Search all sources retrospectively for new indicators.

  • Open to every source

    Any log source, whatever the volume.

Which service fits

Managed SIEM or ACDC?

Both work with logs. The difference is who analyses alerts and who responds to incidents.

Managed SIEM or ACDC?
CriterionManaged SIEMsnapSEC GmbH · This pageACDC – Active Cyber Defense CenterActive Cyber Defense Center Service GmbH
In shortWe run the platform, your team runs detection.The SOC monitors, analyses and responds around the clock.
Who analyses alerts?Your own teamACDC's security operations centre
FocusOperation and availability of the platform, optionally with an SLA24/7 monitoring and threat detection
Who responds to incidents?Your team, following your processesACDC, with triage, agreed escalation paths and support with containment
Rules and use casesCreated and maintained by your teamContinuously tuned by ACDC
Regular meetingsQuarterly maintenance session (approx. 2 h)Regularly, e.g. monthly or quarterly
Suited toTeams with in-house detection know-howCompanies without their own 24/7 team

The two can be combined: ACDC can connect existing SIEM systems. That keeps the path to 24/7 monitoring open whenever your team needs support.

Discover ACDC

Process

From the first call to day-to-day operation

Five steps until your team works with the platform and operation runs in the background.

  1. Clarify needs

    We discuss log sources, retention, evidence requirements and whether you need an SLA for the platform.

  2. Set up and harden

    snapSEC sets up the instance based on Elastic and hardens it to best practice before the first data flows.

  3. Connect sources

    The agreed log sources are connected via integrations or custom pipelines, with retention configured per source.

  4. Hand over rules

    Your team enables and adapts detection rules, writes its own rules and configures alerts.

  5. Run continuously

    Updates, patches and monitoring run in the background. Once a quarter we plan the next steps in about two hours.

FAQ

Frequently asked questions about managed SIEM

What is a managed SIEM?

A managed SIEM is a SIEM platform whose operation is taken over by a service provider. At snapSEC this means we set up your instance based on Elastic, keep it current with updates and patches, monitor health status, components and storage, and harden it to best practice. Your team uses the platform for search, detection and alerts without having to look after the infrastructure.

What is a security data lake?

A security data lake is a central store for security-relevant logs from all sources that are kept for a long time and can be searched at any point. In snapSEC's managed SIEM you connect any log source, whatever the volume, and set retention from days to several years. The data is then available for forensics, evidence and threat hunting, even if an incident only comes to light months later.

Who does what in the managed SIEM?

snapSEC runs, maintains and hardens the platform; your team owns the content. We take care of setup, updates, patches, platform monitoring and retention as you specify it. Your team enables and adapts detection rules, creates its own rules and alerts, and responds to alerts. Once a quarter we meet for a maintenance session of about two hours to discuss how the environment should evolve.

Which log sources can be connected?

In principle any log source, whatever the volume. According to Elastic, the platform ships more than 300 prebuilt integrations for common vendors and tools, for example firewalls, cloud services, operating systems and endpoint products. Sources without a ready-made integration can be brought in through custom pipelines. In the first conversation we work out which sources make sense for your detection and evidence goals.

How long are logs retained?

For as long as you need: from a few days to several years. You set the retention period, for example based on internal policies, contractual or regulatory requirements, and snapSEC implements it in the platform. Within that period the data stays searchable, so that after an incident you can reconstruct events that happened long ago.

Are there ready-made detection rules?

Yes. According to Elastic, the platform provides around 2,000 prebuilt detection rules that your team can enable directly and adapt to its own environment. Your own rules and alert configurations are possible at any time. In the managed SIEM, rule work deliberately stays with you, because your team knows its own systems and use cases best.

Is there an SLA?

Optionally, yes, for the platform. On request we run the managed SIEM with defined SLAs, for example for availability and response times. The SLA covers the operation of the platform, not the analysis of alerts. If you need around-the-clock monitoring and support with incidents, ACDC – Active Cyber Defense Center is the right service.

Who responds to an alert at night?

In the managed SIEM your own team responds, following your processes and on-call arrangements. snapSEC runs the platform but does not analyse alerts. If you need 24/7 monitoring, ACDC takes this on: the SOC analyses logs and events in real time, prioritises incidents by criticality and escalates through paths agreed with you. ACDC can also connect existing SIEM systems.

First conversation

Let us run your SIEM platform.

Tell us which sources you want to connect and how long you need to keep logs. We will propose an operating model based on Elastic that fits.

Book a callSend an email

Destination: snapSEC, Vorchdorf

snapSEC GmbH
Asamerstraße 1b
4655 Vorchdorf, Austria 47°59′ N · 13°55′ E

Personal, without obligation and confidential.