Security information and event management
See the whole picture, not one alert at a time
Attacks rarely show up in just one place. Security information and event management (SIEM) brings relevant activity from covered systems into one correlated view so suspicious patterns that one device alone would not reveal stand out. Covered SIEM alerts are reviewed by a security operations center alongside managed EDR. SIEM adds context.
Covered scope: Silver includes managed servers. Gold and Platinum include managed servers and workstations. Bronze does not include managed SIEM.
SIEM, in plain terms
Managed servers and workstations keep records of important activity – sign-ins, changes, security events, and related signals. Those records are hard to interpret one device at a time. SIEM helps bring relevant records into one place, connect related signals, and make unusual sequences easier for analysts to investigate.
What SIEM gives you
Centralized context
Relevant security activity from covered systems is gathered into one correlated view instead of staying scattered machine by machine. Servers on Silver; servers and workstations on Gold and Platinum.
Cross-system patterns
Related events are connected so a quiet attack spread across several covered systems is easier to spot than any single alert alone.
Actionable alert context
Automated correlation helps surface patterns that merit human review, so analysts can focus on activity that needs attention rather than sorting every raw record.
Analyst review, 24 hours a day, 365 days a year
On every plan that includes SIEM, a security operations center reviews covered SIEM alerts 24 hours a day, 365 days a year – alongside managed EDR on the same device scope. See SOC Alert Review.
Better reconstruction
When something needs investigation, retained history helps document what led up to it.
Works with EDR and SOC
SIEM adds cross-system context to endpoint detection and response so covered alerts make more sense. The SOC reviews the signals; containment runs through managed EDR. See Endpoint Detection and Response and SOC Alert Review.
From collect to follow-up
SIEM collects and correlates. The SOC investigates covered alerts. Containment runs through managed EDR. Neatoware engineers clean up and restore.
Collect
Relevant security activity from managed sources is gathered into SIEM.
Correlate
Related events are connected so patterns that merit review stand out.
Investigate
A SOC analyst reviews the covered alert and context and decides what warrants escalation.
Contain
When a threat is confirmed on a managed-EDR device, the SOC may isolate that device from the network. Isolation limits spread.
Follow up
Neatoware investigates, cleans up, and coordinates recovery under your plan’s initial-response targets after appropriate coordination with you.
Two clocks.
Security clock: SOC review of covered EDR and SIEM alerts runs 24 hours a day, 365 days a year on covered systems.
Engineering clock: Neatoware follow-up follows your plan’s response targets. Routine help desk is Monday to Friday, 9 AM to 5 PM ET. On Platinum, our Priority 1 response target is four hours, 24 hours a day, 365 days a year.
Endpoint Detection and Response · SOC Alert Review · Help Desk · Plans
How correlation can look
1. Sign-in activity
Repeated unsuccessful authentication attempts raise a security signal.
2. Account change
A privileged account change occurs on another managed system.
3. Endpoint behavior
A managed endpoint generates a related security alert.
4. Correlated context
SIEM helps place these events together so a SOC analyst can review the fuller picture.
A single sign-in failure might mean nothing. A series of authentication anomalies, an unexpected account change, and an endpoint alert can tell a more important story when analysts can see the events together. SIEM helps connect relevant security evidence across covered systems; the SOC determines what deserves further investigation.
Which plans include SIEM
Compare SIEM-related coverage across plans. Full plan details live on the Plans page.
| Feature | Bronze | Silver | Gold | Platinum |
|---|---|---|---|---|
| Managed SIEM | Not included | Managed servers | Servers + workstations | Servers + workstations |
| 24/7 SOC alert review (servers)* | Not included | Yes | Yes | Yes |
| 24/7 SOC alert review (workstations)* | Not included | Not included | Yes | Yes |
| EDR / SIEM review scope* | Not included | Covered servers | Covered servers + workstations | Covered servers + workstations |
| SOC isolation | – | Covered device | Covered device | Covered device |
| Help desk hours | Mon-Fri 9 AM-5 PM ET | Mon-Fri 9 AM-5 PM ET | Mon-Fri 9 AM-5 PM ET | Mon-Fri 9 AM-5 PM ET |
| Priority 1 after-hours initial response | Not included | Not included | Not included | Yes** (Priority 1 response target: 4 hours, 24 hours a day, 365 days a year) |
*24/7 SOC means security operations center review of EDR and SIEM alerts on covered systems – servers on Silver and up, workstations on Gold and Platinum. Bronze does not include ongoing managed EDR, SOC, or SIEM. **On Platinum, our Priority 1 response target is four hours, 24 hours a day, 365 days a year.
Endpoint Detection and Response · SOC Alert Review · Help Desk
Where SIEM fits
EDR watches devices. SIEM connects events. SOC analysts review covered alerts. Neatoware engineering and Help Desk stay on their own clocks.
Endpoint detection and response (EDR)
Looks for suspicious behavior on managed servers and workstations. Can support device isolation. See Endpoint Detection and Response.
SIEM
Collects and correlates relevant security event data so patterns are easier to see and investigate. Servers on Silver; servers and workstations on Gold and Platinum.
SOC alert review
Trained analysts review covered EDR and SIEM alerts 24 hours a day, 365 days a year and decide which need escalation or containment. See SOC Alert Review.
Neatoware engineering
Investigates, cleans up, and restores after a SOC escalation or a help-desk request, on your plan’s response clocks. See Plans and Cybersecurity.
Help Desk
Routine support during published hours: Monday to Friday, 9 AM to 5 PM ET. See Help Desk.
Common questions
What is SIEM?
Security information and event management. It collects relevant activity records, called logs, from covered systems, and connects them so suspicious patterns are easier to find. Silver covers managed servers. Gold and Platinum cover managed servers and workstations.
How is SIEM different from EDR – and where does the SOC fit?
EDR watches what happens on each covered server or workstation and can support containment such as device isolation. SIEM looks across covered systems to correlate related events. The SOC reviews covered EDR and SIEM alerts and decides what needs escalation or containment. The three work together; none replaces the others. See Endpoint Detection and Response and SOC Alert Review.
Is SIEM part of my plan?
Yes, on Silver, Gold, and Platinum. Silver covers managed servers. Gold and Platinum cover managed servers and workstations. Bronze does not include managed SIEM. See Plans.
Does SIEM itself stop an attack?
No. SIEM adds context for detection and investigation. Containment can occur through managed EDR when a threat is confirmed. Cleanup and repair are Neatoware’s job under your plan’s response targets.
Does someone review SIEM alerts after hours?
Yes. On covered systems on Silver, Gold, and Platinum, a security operations center reviews covered EDR and SIEM alerts 24 hours a day, 365 days a year. Routine help desk is Monday to Friday, 9 AM to 5 PM ET. Neatoware engineering follow-up after a confirmed security incident follows your plan’s initial-response targets. See SOC Alert Review and Help Desk.
Who removes the threat and restores the computer?
The SOC reviews alerts and may contain a device through managed EDR. Neatoware coordinates technical investigation, remediation, and recovery under your plan’s response targets.
Can we see the logs or receive a report?
Incident communications and follow-up after confirmed escalations follow the reporting process for your plan. Your assigned account representative can walk through what is included for your account. See Plans.
Do we still need internal security responsibilities?
Yes. Your organization still needs decision-makers, escalation contacts, policy ownership, and timely approval where required. Neatoware and the SOC handle the services assigned to them. Your assigned account representative helps keep you informed.
Does the security operations center fix problems itself?
Not by itself. When a threat is confirmed on a device with managed EDR, the SOC can isolate that device from the network. Cleanup and repair are Neatoware’s job, following your plan’s response targets.
Endpoint Detection and Response · SOC Alert Review · Help Desk · Plans · Cybersecurity
Know what your security tools can see – and who reviews what they find
Silver covers managed servers; Gold and Platinum add workstations. Compare plans, run the pricing calculator, or book a call to see how SIEM fits with managed EDR and SOC alert review on the devices you depend on.