Intelligent Security Information and Event Management (SIEM)

The Intelligent SIEM’s awareness comes from creating a dynamic usage profile of infrastructure assets, current configurations, recent changes, dynamic asset-to-business service mappings, and user discovery from Active Directory and OpenLDAP databases.

Bell Cyber enriches this data with continuously updated external threat intelligence sources, including IP reputation, domain reputation, malware user agents and malware hashes. The situational awareness is appended to logs and enables the rule engine to correlate the information in real time to generate accurate, actionable intelligence alerts and reports.

Robust, scalable log management

Full feature list:

• Mainstream device support
• Event source monitoring
• Event log and network flow data consolidation
• Comprehensive, extensible analytics
• Network, virtualization and application intelligence
• Identity and location intelligence
• Configuration and configuration change monitoring
• Database security, availability and anomalous activity monitoring
• Powerful, Layer 7 rules engine
• Real-time and historical cross-correlation

The Intelligent SIEM also delivers:

• Collection, parsing and correlating from anywhere
• Machine data search - Compliance automation
• Real-time event correlation
• Advanced log management
• Big data analytics
• Visual analytics
• Advanced threat management

Real-time threat intelligence

We take responsibility for curating the data to ensure the output is contextual and actionable. Threat intelligence has been vertically integrated as part of the Intelligent SIEM to further enhance its core functions. Our unique approach results in increased speed and accuracy of detection, while simultaneously enhancing the response process by gaining additional context about the threat. The ingestion of threat intelligence enables Bell Cyber to proactively identify new and emerging threats to your industry, business, facilities, executives and employees.

Vulnerability management

Vulnerability management enables Bell Cyber to discover rogue devices, identify and track vulnerabilities, prioritize, and verify remediation.

In partnership with Qualys, Bell Cyber will conduct internal and external vulnerability scans within your environment on an annual, bi-annual or quarterly basis based upon your specific needs. We take a pragmatic, business-first approach to vulnerability management by identifying all known vulnerabilities while highlighting those which impact mission- and business-critical systems for prioritized remediation.

Asset management – Configuration Management Database (CMDB)

Virtually every security framework calls upon corporate IT to maintain full visibility across all network-connected assets, their role and relationship to the business, to one another and to privileged users. A Configuration Management Database (CMDB) acts as a data warehouse. Its contents are intended to hold a collection of IT assets that are commonly referred to as Configuration Items (CI), as well as descriptive relationships between such assets. When populated, the repository becomes a means of understanding how critical IT assets are composed, what their upstream sources or dependencies are, and what their downstream targets are.

24/7 Cyber Intelligence Centre (CIC)

The Bell Cyber CIC operates under strict, need-to-know access controls; only authorized employees are given access to the facility. All activity is monitored using HD video surveillance. Bell Cyber’s state-of-the-art CIC incorporates Content-as-a-Service capabilities to aggregate, validate and share anonymous threat data gathered from other industry sources, providing benchmark and threat detection intelligence to customers in near real-time.

Incident management and ticketing

Bell Cyber's SECaaS includes integrated incident management and ticketing. We have strategically partnered with ServiceNow, the market leader in IT Service Management (ITSM). The incident management process is tailored to each customer and is automatically triggered as new security incidents are identified. Having a well-defined incident management process ensures that Bell Cyber's SECaaS customers are best prepared to handle incidents in an efficient and effective manner. Bell Cyber's Cyber Intelligence Analysts work directly with their customer counterparts to assist with incident management.

System Health Monitoring (SMH)

While event log monitoring can relay certain alerts from the operating system, it is insufficient for accurate monitoring and tracking overall system health. Bell Cyber’s SECaaS incorporates System Health Monitoring designed to natively monitor all core components of the operating system. SMH not only raises alerts for immediate problems, but also collects historical information for later analysis, trend prediction and real-time overview. Bell Cyber provides role-based, read/write access to our SECaaS for customers wishing to access this data for their own internal (non-security related) use cases.

Application Performance Monitoring (APM)

Bell Cyber’s SECaaS incorporates Application Performance Monitoring (APM) that delivers a deep view of performance across your website(s) or specific applications. We leverage APM to identify and troubleshoot performance-related issues that may be caused by a security-related incident or attack. Bell Cyber provides role-based, read/write access to our SECaaS for customers wishing to access this data for their own internal (non-security related) use cases.

Center for Internet Security (CIS) Enterprise Risk Dashboard/Calculator

The Center for Internet Security (CIS) Top 20 Critical Security Controls are designed to prevent a majority of cyber attacks by measuring and reducing cyber risk. Bell Cyber has developed a proprietary Enterprise Risk Calculator (ERC) based on those controls. As part of the onboarding process, Bell Cyber consultants will interview clients to obtain the data points and artifacts necessary for scoring and validation. Once complete, the ERC will offer a clear, business-contextual view into the security and risk profile of your environment.