What does the SIEM in SecTepe.Comm do?

It is an open-source security platform with SIEM and XDR features. Small programs (agents) on servers and endpoints collect logs and events. The central server checks them against rules, and a dashboard shows alerts and reports. It also spots changed files, rootkits and vulnerabilities.

Do I pay license fees for the SIEM?

No. The software is open source, so there are no license fees per data volume or agent. Costs come from running it, storage, rule maintenance and reviewing alerts. That is exactly the effort we take off your hands with SecTepe.Comm.

Where does the data live?

In SecTepe.Comm, the SIEM runs in your own environment. Logs and security events stay under your control. They do not go to a cloud SIEM vendor.

Do I also need a SOC?

A SIEM collects and rates events. But someone has to read the alerts and respond. No team of your own for that? Our Security Operations Center can take on this task.

Does a SIEM help with NIS2?

Yes, as one building block. NIS2 requires you to detect and handle security incidents. You must send a first report within 24 hours. That is hard to do without central log analysis. A SIEM alone does not meet NIS2, though. You also need processes, roles and evidence.

Does the web firewall block attacks today?

Not yet. It runs in detection mode and logs rule hits. A collector writes these hits to the search index. With that data, you can judge false alarms before you turn blocking on. A separate firewall service is in development and not yet in the request path.

Does the web firewall store request content?

No. Its audit log leaves out the content of requests. So passwords and form data do not end up in the index.

Can the SIEM act on an endpoint?

Yes. It can isolate a host, stop a process or quarantine a file. A SecTepe.Core analyst must approve each action under the four-eyes rule first.

SecTepe.Comm

Security & SIEM

SecTepe SIEM & Security– Zero Trust by Design

SecTepe.Comm builds security in from the start. A central SIEM analyzes all logs. A vault protects passwords and keys. A web application firewall checks requests to your web services. And all services talk to each other only over encrypted links (mTLS).

Request a demo

At a glance

Central SIEM
Vault for credentials
Web application firewall
Encryption between services
Alerts on changed files
Reports for audits

Features at a glance

A complete security stack, built into SecTepe.Comm and active from day one. It shows you what happens on each server and keeps your secrets safe. A web firewall and encrypted links (mTLS) complete it.

Central SIEM

Agents watch your endpoints, servers and containers. The SIEM analyzes all logs and events in one place and raises alerts in real time. Ready-made rules fit your services.

Vault for Credentials

API keys, certificates and database passwords are kept safe in one place. The vault hands out keys on demand, plus tokens that expire fast.

Web Firewall (OWASP CRS)

The web application firewall checks requests to your web services for common attacks. It uses the OWASP Core Rule Set for this.

Encrypted Links Between Services

Each service gets its own identity and talks only over encrypted links (mTLS). You do not have to change your apps. So zero trust applies from day one.

File and Rootkit Protection

The SIEM reports when important files change. It also finds rootkits on all managed servers.

SIEM Dashboards

Ready-made dashboards show where you stand on ISO 27001, BSI, PCI-DSS, HIPAA, NIST and GDPR.

Technology & integration

We rely on proven open-source building blocks that have long been standard in big clouds. We bring them into your own data center. The SIEM collects and links events. The vault keeps your secrets. The web firewall guards your web services. The service mesh encrypts every internal link (mTLS).

• SIEM server and agents on your systems
• Vault for passwords and keys
• Web firewall with the OWASP rule set
• Service mesh: encrypted links between services
• Search index for all events
• Alerts by chat or email

Your benefits

Security built in from the start
All security events in one place
Reports ready for audits
Encryption (mTLS) for all services with no extra effort

How Security & SIEM works in practice

The stack has four parts: the SIEM, the vault, the web firewall and the service mesh. Each one covers a different layer. Their events end up in one place. So your team works from one picture instead of four.

How the parts fit together

SIEM agents run on your servers. They send events encrypted to the SIEM server. The server stores alerts in a search index.
The vault holds passwords, API keys and certificates. It also encrypts stored data for SecTepe services. Every access lands in an audit log that the SIEM reads.
The reverse proxy passes web requests to the web firewall (WAF). The WAF checks them against the OWASP Core Rule Set, a common rule set against web attacks.
On Kubernetes, the service mesh encrypts the traffic between services (mTLS). Each service gets a certificate that is valid for 24 hours and renews on its own.

Typical use cases

Spot changed files on your servers and find known vulnerabilities (CVEs) in installed software.
Get an alert when someone reads or changes secrets in the vault. A dedicated rule set in the SIEM covers its audit log.
Catch failed encrypted connections between services and certificates that are about to expire.
Send serious alerts to the SOC dashboard. From a set severity level up, the SIEM passes each alert to the event bus.

Operation and data control

You run the stack in your own setup. It works with containers on a single server or on Kubernetes, for example at IONOS. Alerts stay in the search index. By default, they are deleted after 90 days.

The SIEM dashboard sits behind the central login. The web interface of the vault is only reachable over VPN. Customers can get their own view of their logs. The central login tells the SIEM which customer is asking. So each query only shows the data of that customer.

SecTepe SIEM: what it does

SecTepe SIEM builds on an open-source platform for security information and event management (SIEM). Small agents on servers and endpoints send logs and events to the SIEM server. It checks them against rules and flags suspicious patterns. The data sits in a search index. The dashboard shows alerts, trends and reports.

Typical jobs the SIEM takes on:

Collect and analyze system, application and security logs in one place
Spot changes to important files (file integrity monitoring)
Find rootkit and malware indicators
Find vulnerabilities and weak configurations on endpoints
Build reports you can use for audits and compliance evidence

In SecTepe.Comm, the SIEM is already set up with rules for all platform services. Our article on thezero trust stack of SIEM, vault and web firewallshows how the parts work together. If you want alerts reviewed around the clock, combine the SIEM with ourSecurity Operations Center.

Technical foundation

SecTepe SIEM is based on Wazuh and stores its data in an OpenSearch index. OpenBao is the vault, and Coraza with the ModSecurity rule set is the web firewall. Linkerd runs the service mesh, Traefik the reverse proxy.

Frequently asked questions about the SIEM

What does the SIEM in SecTepe.Comm do?: It is an open-source security platform with SIEM and XDR features. Small programs (agents) on servers and endpoints collect logs and events. The central server checks them against rules, and a dashboard shows alerts and reports. It also spots changed files, rootkits and vulnerabilities.
Do I pay license fees for the SIEM?: No. The software is open source, so there are no license fees per data volume or agent. Costs come from running it, storage, rule maintenance and reviewing alerts. That is exactly the effort we take off your hands with SecTepe.Comm.
Where does the data live?: In SecTepe.Comm, the SIEM runs in your own environment. Logs and security events stay under your control. They do not go to a cloud SIEM vendor.
Do I also need a SOC?: A SIEM collects and rates events. But someone has to read the alerts and respond. No team of your own for that? Our Security Operations Center can take on this task.
Does a SIEM help with NIS2?: Yes, as one building block. NIS2 requires you to detect and handle security incidents. You must send a first report within 24 hours. That is hard to do without central log analysis. A SIEM alone does not meet NIS2, though. You also need processes, roles and evidence.
Does the web firewall block attacks today?: Not yet. It runs in detection mode and logs rule hits. A collector writes these hits to the search index. With that data, you can judge false alarms before you turn blocking on. A separate firewall service is in development and not yet in the request path.
Does the web firewall store request content?: No. Its audit log leaves out the content of requests. So passwords and form data do not end up in the index.
Can the SIEM act on an endpoint?: Yes. It can isolate a host, stop a process or quarantine a file. A SecTepe.Core analyst must approve each action under the four-eyes rule first.

Ready for zero trust security?

Let's make your SecTepe.Comm setup harder to attack. We help you roll out the SIEM, tune the WAF and enforce mTLS.

Request a demo Back to SecTepe.Comm

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.