Threat Intelligence, SIEM, and SOC

What is threat intelligence?

• Due to the rapidly changing nature of cybersecurity threats, if your defensive systems are not automated, they cannot hope to actually protect you

• Dolce Vita’s threat intelligence uses cybersecurity solutions which are highly integrated and automated…they use multiple aggregated threat hunting systems to pull up-to-date threat information. This information is available and is utilized in real time with no manual configuration changes needed

• Various compliance frameworks such as CMMC (Cybersecurity Security Model Certification) require the use of threat intelligence and SIEM

• Threat intelligence has to be actionable…with Dolce Vita it acts in real time, 24/7!

What is SIEM (Security Information and Event Management) and SOC?

• in modern networks the critical network components (firewalls, switches, wireless access points) and servers will generate hundreds of thousands of log entries per day

• SIEM uses artificial intelligence to learn about normal behavior and to alert on abnormal security behavior

• SIEM pulls logs from firewalls, switches, wireless, software, and hardware to aggregate, digest, and analyze

• The SIEM is under 24x7 review by our security operations center (SOC) and we are alerted within minutes of important events which require attention. This is of critical importance in aviation and CMMC-related manufacturing, healthcare, and financial services where thousands of threats occur daily.

How does threat intelligence protect my business?

• with our threat intelligence the system works seamlessly with network components to halt access to risky locations on the internet

• Our threat intelligence uses a risk-based approach to classify potential threats and block them automatically using your firewall’s remote blocklist capability

• The SIEM processes current event logs from the business’ firewall and servers (among other components), parses the data streams and is matched in real time to over 30 threat intel streams. In real time the firewall blocklists are updated and when a threatening IP address is attempted it is automatically blocked without any interaction required by the system administrator. That’s fast!

• Threat intelligence protects our clients thousands of times per day!