From MSP to MSSP using Elastic
0 likes760 views
The document outlines Eze Castle's transition from a Managed Service Provider (MSP) to a Managed Security Service Provider (MSSP) using Elastic technology, highlighting the challenges faced with log management and security visibility. Key milestones in their integration journey include partnerships with third-party vendors, onboarding systems, and product relaunches, emphasizing the benefits of using Elastic's cloud and support services. The initiative has led to significant improvements in event ingestion rates, threat feed integrations, and overall customer onboarding times.
From MSP to MSSP using Elastic
- 1. From MSP to MSSP Our Journey with Elastic
- 2. Eze Castle Integration Overview Managed Service Provider (MSP) Cloud Service Provider (CSP) Internet Service Provider (ISP) Managed Security Service Provider (MSSP)
- 3. Technology Growth at Eze Castle
- 4. The Challenge •Technology Silos Each department or team managing their own logs •Non-standard Formatting Logs stored in original format without normalization •Compliance with Regulatory Requirements and Guidelines Difficultly guaranteeing log retention •Search Finding needles in haystack •Detection and Response Lack of visibility on suspicious activity
- 9. Do It Right the First Time One-on-one with experts Validate your design Ask anything! Less Headache Easy to scale Easy to upgrade No infrastructure Great feature parity Cost effective Do It Right All the Time Great instructors Instructor-led and on-demand Full-blown lab Great content Get Help When You Need It Good response time Knowledgeable Team Phone Support Dedicated Support Engineer ServicesWe Use ELASTIC CLOUD ELASTIC CONSULTING ELASTIC LEARNING ELASTIC SUPPORT
- 10. YESWE CAN! Filebeat Dozens of built-in modules supporting ingest via syslog, API, or reading text files with Filebeat and Logstash Logstash No Filebeat module? No problem!
- 11. Managed SIEM –Technology Integrations Elastic Built-in Filebeat Modules Custom Developed ActiveMQ Apache Auditd AWS AWS Fargate Azure Barracuda Bluecoat CEF Check Point Cisco CoreDNS Crowdstrike Cyberark Cyberark PAS Cylance Elasticsearch Envoyproxy F5 Fortinet Google Cloud Google Workspace GSuite haproxy IBM MQ Icinga IIS Imperva Infoblox Iptables Juniper Kafka Kibana Logstash Microsoft MISP MongoDB MSSQL MySQL MySQL Enterprise nats NetFlow Netscout Nginx Office 365 Okta Oracle Osquery Palo Alto Networks pensando PostgreSQL Proofpoint RabbitMQ Radware Redis Santa Snort Snyk Sonicwall Sophos Squid Suricata System Threat Intel Tomcat Traefik Zeek (Bro) Zoom Zscaler Citrix Netscaler DMARC iboss Microsoft DHCP Proofpoint TAP SentinelOne SpyCloud 2+ billion events per day avg. ingestion rate, that’s 23,148 events / second
- 12. Eze Managed SIEM –Threat Feed Integrations Pre miu m Fee ds SOC Prime Bad Packets Co mm unit y Fee ds Alienvault OTX CINSscore CyberCrime Tracker Feodo Tracker FireHOL GreenSnow IPSum ListDynamic DNS providers MalShare MalSilo OpenPhish Phishtank Proofpoint Emerging Threats TOR Exit Nodes Vxvault
- 13. What Happened Since Values shown are accurate as of June 02, 2021 < 2 Weeks avg. onboarding time per customer
- 14. • More integrations • More enrichment • More machine learning • More beats • Elastic Agents Next Steps
- 15. www.eci.com