Services
Managed SIEM
Your logs already tell the story – they’re just scattered across Cloudflare, your web server, WordPress and your servers. I bring them together in a SIEM I run and maintain for you, hosted in Australia, and watch it for attacks, unusual traffic and problems in the making – so when something needs attention, you hear what happened and what to do next.
At a glance
Who it’s for
Businesses on any Cloudflare plan who want one view of everything.
Where the logs go
An open-source SIEM I run and maintain, hosted in Australia.
What you get
Alerts with context, and a weekly report in plain English.
Hours
Watched in business hours, with alerts set up to flag anything serious outside them.
Cost
Setup quoted up front, then part of your retainer. Full Cloudflare logs are quoted on top.
What goes in
The whole picture, not one data point
A SIEM (security information and event management system) collects logs from everywhere in one place, so they can be searched, connected and alerted on. One source only tells part of the story. Together, they show things no single log can – like traffic reaching your server without going through Cloudflare, or a site slowing down because the server is running out of memory.
Some sources need a small agent installed on your servers. Others, like Cloudflare and network devices, send their logs directly. The more that goes in, the more complete the picture.
Logs I can bring in
- Cloudflare: every request, security event and audit log, through Logpush
- Web server access and error logs
- WordPress: logins, failed logins, and changes to users, plugins and settings
- Linux: syslog, journald and audit logs
- Windows: Event Viewer security, system and application logs
- Firewalls, routers and other devices that can send syslog
What I watch for
Signal, not noise
I tune the alerts to your normal traffic and your systems, so a busy sale day doesn’t look like an attack and you only hear about what matters.
Attacks
DDoS, credential stuffing, bot floods and spikes in blocked requests – and repeated attempts to log in to WordPress or your servers.
Going around Cloudflare
Requests that reach your server without coming through Cloudflare, so a gap in your origin lockdown shows up straight away.
Problems in the making
Errors from your web server, a server running low on memory or disk, and services that keep restarting – before they turn into an outage.
Risky changes
New admin users, plugin and settings changes, and changes to your Cloudflare rules, DNS records, API tokens and members.
How it’s set up
From scattered logs to useful alerts
1
Scope
We agree which systems and logs go in, how long they’re kept and who can see them.
2
Connect
Cloudflare’s Logpush sends your Cloudflare logs straight to the SIEM. A small agent on your servers sends the rest over an encrypted connection.
3
Tune
Alert rules are tuned to your normal traffic and your systems, so you hear about what matters.
4
Watch and report
I watch it in business hours, alerts flag anything serious outside them, and you get a weekly report of what was seen.
Good to know
Before you start
Hosted in Australia
It’s a SIEM I run and maintain myself, not a third-party product, and your logs are stored in Australia. Each client’s logs are kept separate.
Full Cloudflare logs
Cloudflare’s Logpush sends a record of every request and security event to the SIEM, so nothing is missed and any Ray ID can be looked up. It used to need Enterprise, but it can now be turned on for any plan. Cloudflare includes a set amount of log data each month for free, which is plenty for many websites, and charges for anything over that. Taking in and processing the logs adds to my costs too, so they’re quoted on top.
One Ray ID is enough
Every request Cloudflare handles gets a Ray ID. With Logpush sending your Cloudflare logs to the SIEM, the Ray ID from a customer’s error page shows exactly what happened to them. More in what a Ray ID is.
Your data
Logs include your visitors’ IP addresses, so they’re kept only as long as we agree, and only what we agree goes in.
Want one view of everything your systems are telling you? Tell me what you run, and I’ll tell you what’s worth collecting.
Under attack right now? Call +61 2 8363 3348.