The customer is a premier real estate firm that wants tenants and property owners to have a seamless online experience in the properties it manages, covering maintenance scheduling, payments, security and more. It runs multiple cloud-based applications to support them, alongside on-premises systems. The firm is mid-sized but has only a small security team, and a corporate cloud-first initiative requires any new solution to be cloud-based.

The firm gathers a huge amount of security data from cloud applications, including Google Apps, CrowdStrike and PingFederate, and from on-premises solutions such as Windows, Proofpoint, proxies, firewalls, CyberArk and Cylance. With data spread across multiple environments, meaningful analytics was extremely difficult, and the cost and operational overhead of maintaining that data was excessive. The firm was also relying on on-premises security tools to protect its cloud applications, which was not working.

Although it is a mid-sized company, the firm has only a small security team. It needed next-generation capabilities with minimal operational overhead, so that the team could spend its time investigating and remediating threats rather than managing its security tooling.

The organization's cloud-first initiative added a further constraint: any new solution had to be a single, end-to-end, cloud-based platform for information storage and analytics.

Securonix Next-Generation SIEM met the requirement for a single end-to-end solution. The cloud-based platform ingests a wide variety of data sets, stores them in centralized data storage, and applies artificial intelligence and machine learning analytics to detect cyber threats.

To bring the scattered data sources together, Securonix used its API connectors to ingest data from the firm's cloud applications and syslog forwarding through remote ingestion nodes for the on-premises data. The result was one multi-tenant infrastructure holding all of the organization's security telemetry.

Because the platform is implemented rapidly and its infrastructure is completely managed by Securonix, the firm saw a shorter time to value and no longer had to maintain the underlying system. The security team also gained access to the Securonix knowledgebase of the latest threats discovered by Securonix researchers, and can quickly implement new threat models or create customized models for its own use cases. The analytics run on the SNYPR Cloud Platform.

• Saved months of deployment time
• Cut 60-70% of resource time spent on configuration and ongoing monitoring
• Realized cost savings by consolidating scattered data sources onto one cloud SIEM
• Security staff refocused on responding to threats instead of managing infrastructure
• Detected and responded to a major Office 365 phishing campaign that had previously gone unnoticed