Detect cyber threats with managed SIEM

Complete coverage

Complete coverage

Ingest logs from all sources including applications, endpoints, servers, network devices and cloud environments.

Identify threats

Identify threats

Never miss a genuine security threat with our team of SOC analysts monitoring your network 24/7 on your behalf.

Prevent breaches

Prevent breaches

Quickly respond to threats and protect your business with clear, step-by-step remediation actions.

Grow your business

Stay compliant

Meet the requirements of PCI DSS, GDPR and other regulatory standards with proactive monitoring and reporting.


Collect and search logs

Collect and search logs

With Defense.com managed SIEM you can send security logs from any device or system to maintain complete visibility over your environment. We use machine learning and human expertise to analyse your logs and detect any threats on your behalf.

If you need to, you can quickly search up to 90 days of logs at any time, plus get up to 1 year of archived as standard for no extra cost.

Tailored security alerts

Tailored security alerts

Our experienced SOC team will eliminate alert fatigue by proactively monitoring your network for suspicious activity and only bringing genuine security concerns to your focus.

Know exactly where to focus your attention with automatic alert prioritisation, a clear overview of the event details and the steps you need to take to remediate the threat.

Actionable advice

Actionable advice

Spend less time investigating each alert with detailed remediation guidance. From multiple failed logins to unauthorised software installation, when a security event is triggered you’ll get step-by-step advice about how to combat each threat, helping you to remediate them quicker.

Start seeing immediate security value with our default list of alerts, or create your own custom versions to get notified to other types of activity in your network.


Managed SIEM service highlights

Defense.com Managed SIEM delivers everything you need to detect cyber threats and prevent breaches.

Magnifying glass

24/7/365 monitoring of systems, networks, applications and users

Brain with power cable

Ingest security logs from any device, system or vendor

Head with a clock inside

Simple and automated deployment for on-premises devices

Magnifying glass

Support for cloud services including Azure, AWS, GCP and Salesforce

Brain with power cable

Get real-time threat intelligence data from multiple sources

Head with a clock inside

Scalable pricing model that isn't based on log volumes


Learn more about our Managed SIEM service

Onboarding process

Our team will guide you through your SIEM deployment to help you get onboarded quickly and start seeing immediate security value.

Why choose Defense.com? Why choose Defense.com?

Why choose Defense.com?

A key component of our Managed SIEM service is our in-house Service Operations Centre (SOC) with 24/7 coverage across the UK and US.

Our experienced analysts will become an extension of your team, proactively looking for malicious activity in your network and taking full ownership of your SIEM service.

Unlike most other solutions on the market, Defense.com delivers clear, step-by-step remediation advice whenever there is a security event so you can fix issues fast and get back to other tasks.

Protect your business from cyber attacks

With Defense.com Managed SIEM, your network will be monitored 24/7/365 for suspicious activity, helping to identify threats and prevent breaches. We’ll help you quickly improve your security posture with our fully managed service.

Here’s what our customers say about us

Protecting the world’s leading brands

Get a quote

Detect cyber threats and improve your security with our managed SIEM service.

For more information about how we collect, process and retain your personal data, please see our privacy notice.

Frequently Asked Questions

A Security Information and Event Management (SIEM) solution takes log data from various sources within your network and identifies any suspicious activity. If a security event is spotted, an alert can be raised so that remedial action can be taken.

An outsourced managed SIEM solution will proactively monitor and investigate network activity on your behalf. Any security events or outcomes are escalated directly to you, instead of floods of alerts.

Choosing to outsource SIEM to a third party can be seen as the most balanced option in comparison to building your own solution or buying an off-the-shelf product.

A managed SIEM service allows you to save time and resource by letting a third party proactively look for threats on your behalf. You’ll also benefit from no dedicated hardware or support contracts to manage and access to a wider variety of threat intelligence.

By using a managed SIEM solution such as Defense.com, you can combine the best of technology and human expertise for 24/7 threat monitoring.

For collecting logs within your network, we will provide you with the scripts and documentation for setting up a collector using Ubuntu, which needs to be installed on a standalone virtual or physical machine inside your network.

Once this is complete, we'll then ask you to deploy a couple of agents on your client devices (Winlogbeat & Filebeat) which will send the logs from these devices to the collector on the Ubuntu machine. Your logs will then be encrypted and sent to our Defense.com SIEM platform for processing.

For cloud environments like AWS and Azure we can usually collect logs via the provided API. Our team will work with you to ensure that you are collecting logs from all necessary areas of your environment. If we do not currently have an integration with your particular vendor or device then we will either find a workaround to bring the logs in or look to develop a custom integration.

FWe can ingest almost any source of log data that provides security value, regardless of the vendor or product.

This can include high-fidelity logs such as:

  • IDS/HIDS logs
  • WAF logs
  • Endpoint protection logs either from your existing solution or via the Defense.com agent

As well as additional low-fidelity logs that have less context on their own such as:

  • Firewall logs
  • Switch logs
  • Flow logs

These additional log sources help to detect attempts to laterally move to higher value assets such as Active Directory servers. This could occur when lower value assets are compromised such as workstation devices or lower criticality servers. These types of sources also provide indicators of attacks that can often not be detected using logs alone.

The more log data that we can ingest into Defense.com the more we can build a clearer picture of your environment and correlate information from different sources to drive informed decision making.

Alerts come through as a security event in your Defense.com account, which provides the details of what we have detected and answers the 'who, what, when and how'. We also create a threat connected to the security event, which provides clear remediation advice on how to address and contain what has been found.

Runbooks are used to standardise incident response processes and to ensure that the appropriate steps are taken to contain, eradicate, and recover from security incidents.

Our runbooks include the following elements:

  1. Process overview: The steps taken to perform incident triage, incident escalation, and gives guidance on incident resolution.
  2. Containment procedures: The steps that should be taken to contain a security incident, such as isolating affected systems, shutting down access to affected systems, and implementing other containment measures.
  3. Eradication procedures: The steps that should be taken to eradicate a security incident, including identifying and removing malicious software, patching vulnerabilities, and implementing other remediation measures.
  4. Recovery procedures: The steps that should be taken to recover from a security incident, including restoring systems and data, and conducting a post-incident review to identify areas for improvement.
  5. Monitoring and detection procedures: The steps that we will be taking to detect and monitor security incidents, including configuring and maintaining our platform, and analysing log and event data.

Our SOC team assesses and prioritises all alerts and performs threat hunting and investigation in order to reduce false positives. The analyst will then either raise the security event or use it to further tune the environment. All events that are false positives are still recorded for audit purposes.

A well-documented profile is critical to our detection capabilities. We create a profile during your onboarding process and define runbooks specific to your environment to ensure that false positives are kept to a minimum. This is a standard process of our onboarding and ongoing service to reduce alert fatigue.