Managed SIEM and XDR
Events from PCs, servers and cloud accounts collected in one place, correlated to recognise an attack and retained for investigation, with a SOC that reads them for you.
SIEM as a service: the logs that matter, read by someone
Every PC, server and cloud account produces thousands of events a day: sign-ins, errors, changes, connections. Taken one by one they say almost nothing. Put together they tell you whether someone is trying to get in, whether they have succeeded and what they are doing.
The Dottor Box managed SIEM collects these events, centralises them, correlates them and retains them. The XDR functions recognise the behaviour of an attack and, according to agreed rules, react on the endpoint. On top of this work the analysts of our SOC.
The sensor that collects the data on the computers is the Cyber Agent. This page describes the service around it: what is collected, how it becomes a useful alert and how it becomes evidence for NIS2 and ISO 27001.
A SIEM with nobody reading it just makes noise. The value is not in the quantity of logs, it is in who decides which ones matter.
SIEM, XDR and EDR: what is the difference
Three acronyms that often overlap. To find out more, read the guide on what a SIEM is.
| Acronym | What it does | Where it looks |
|---|---|---|
| SIEM (Security Information and Event Management) | Collects, centralises, correlates and retains security events; generates alerts based on rules | Several sources: endpoints, cloud services, network systems |
| EDR (Endpoint Detection and Response) | Detects malicious behaviour and responds on a single computer | The endpoint only |
| XDR (Extended Detection and Response) | Extends detection and response by linking events from different sources | Endpoints, identities, cloud and network together |
In practice. The SIEM gives you memory and context, XDR the ability to recognise and stop an attack in progress. Dottor Box combines them: the same data serves the immediate alert and the investigation months later.
Log management for endpoints and the cloud
A SIEM only makes sense if it sees the right sources. Dottor Box brings three of them together, in a single platform, with each customer's data in a dedicated environment.
Logs are centralised for up to 6 months, to support forensic analysis and incident investigation.
Endpoints, through the Cyber Agent
Logins, critical security events, file integrity, changes to the system registry, error logs, firewall logs and network connections from PCs and servers, with an HIDS service that generates alerts.
Microsoft 365 and Entra ID sign-ins
Successful and failed sign-ins to the tenant, with alerts on repeated attempts, countries never seen before and administrative logins. Blocking an account remains a proposal until a person confirms it. Microsoft Entra ID.
Google Workspace sign-ins
Sign-ins to the company's Google accounts go into the same log, alongside those from workstations. Google Workspace.
XDR for businesses: from event to action
The XDR functions turn a list of events into a picture you can read, and in some cases into an immediate reaction. The technical detail of each one is on the Cyber Agent page.
Correlation with MITRE ATT&CK
Every detection is placed in the tactic and technique of the MITRE ATT&CK framework: you know which phase of an attack you are in.
Malware and rootkits
Known signatures, hidden processes and files, comparison with lists of indicators of compromise and alerts from the antivirus already in place.
Behaviour analysis
Events that are harmless on their own, suspicious together: repeated failed logins, then a new administrator, then a modified system file.
Agreed automatic response
Based on rules decided together at activation, such as temporarily blocking on the local firewall an address that is attempting a brute-force attack.
CIS benchmarks
Operating system configurations compared with hardening policies based on the CIS benchmarks, with guidance on how to fix them.
Threat intelligence and hunting
Events compared with threat intelligence sources, and a history analysts can query for threat hunting.
Why a SIEM needs to be managed
Many companies that have installed a SIEM on their own end up with one of two opposite problems: too many alerts, which end up being ignored, or rules so permissive that nothing ever fires. Either way the system is there, but it neither protects nor documents.
In the managed service this work is done by Dottor Marc's SOC: false positive management for accurate notifications, correlation of security data, predictive analysis and proactive hunting for hidden threats. It is already included in the Security Monitor level.
With the MDR + SOC and MDR + SOC 24/7 levels, SIEM alerts go to our team, which steps in to contain the threat and start the incident response.
- An immediate email on critical events, with the title in your language, Italian or English
- Exclusion rules to silence recurring noise that has already been assessed
- One email per recipient, with no chains of copies
- PCs and servers with antivirus not active are flagged
- Automatic responses enabled only if chosen, never by surprise
Log management for NIS2, ISO 27001 and system administrators
System administrators. The Italian Garante's 2008 order on system administrators (Gazzetta Ufficiale no. 300 of 24 December 2008) requires the logins of system administrators to be recorded and kept for at least six months. The SIEM collects these logins and brings them into the access log register, which can be exported as CSV. The topic is explained in the guide to system administrator logs and on the page dedicated to system administrators.
NIS2. The risk management measures required by the directive and by D.Lgs. 138/2024, the Italian law transposing NIS2, include incident handling and the ability to detect incidents. Without centralised logs it is hard to reconstruct what happened and notify it within the required deadlines. NIS2 compliance.
ISO/IEC 27001. The Annex A controls on event logging and on monitoring activities find their technical evidence in the SIEM. See the ISO 27001 checklist.
Questions about managed SIEM and XDR
What is a managed SIEM?
It is a SIEM you do not have to install, configure and watch over yourself. The provider collects and retains the logs, maintains the correlation rules and provides analysts who read the alerts. In Dottor Box collection takes place through the Cyber Agent and the connections to cloud environments, and the analysis work is done by Dottor Marc's SOC.
How long are logs retained?
Log centralisation covers up to 6 months, to support forensic analysis and incident investigation. This is consistent with the minimum period of six months that the Italian Garante's order on system administrators requires for login records. The access log can be exported as CSV as evidence.
What is the difference between XDR and EDR?
EDR detects and responds to threats on a single computer. XDR takes a wider view: it links events from different sources, such as endpoints and cloud identities, to recognise an attack that would go unnoticed on a single machine.
Does the SIEM block attacks by itself?
It can, but only where you decide. Automatic responses, such as temporarily blocking an IP address on the local firewall, are agreed at activation. Blocking a Microsoft 365 account, on the other hand, is never automatic: the platform proposes it and a person confirms it.
Do you need a SIEM to comply with NIS2?
NIS2 does not require a specific product, but it does require measures to detect and handle incidents and to notify them within the required deadlines. A SIEM with centralised logs is one of the most direct ways to do this and to prove it with evidence.
Often activated together
SOC and MDR
Dottor Marc's Security Operation Center: monitoring, managed response and, if you need it, 24/7 cover.
Learn more SeeCyber Agent
The endpoint agent: security events, file integrity and clear, readable alerts.
Learn more SeeAccess logs
System administrator logins collected and retained as the Italian Data Protection Authority requires.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.