Skip to main content

SIEM & Security Logging Plan

The SIEM & Security Logging plan gives you compliance-grade security monitoring across your entire KloudBean environment: centralized event logging, file integrity monitoring, tamper-proof long-term retention, real-time alerting, and audit-ready evidence — all in one access-controlled platform.

How This Relates to Enterprise​

Security operations span two offerings:

  • The Enterprise plan covers core security operations — vulnerability management, prioritized fixes, patching, and general security support.
  • The SIEM & Security Logging plan covers the deeper, compliance-focused layer: Security Operations Center (SOC) style monitoring, centralized security logging, and long-term forensic retention.

In other words, if your organization needs to prove its security posture to auditors and regulators — not just maintain it — the SIEM plan provides the logging, retention, and evidence to do so. It is designed specifically for compliance.

note

The SIEM & Security Logging plan is a specialized add-on and is not automatically part of every Enterprise engagement. Ask your account manager to include it when scoping your plan. See Upgrading to the Enterprise Plan.

Where to Find It​

Each server has a Security logging tab under Server Administration. This is the Security Logging & Compliance page, where the server's cybersecurity logging posture — event coverage, log format, retention, and 24x7 alerting — is governed and mapped to your organization's controls framework. Selections are recorded per server as a point-in-time control attestation and saved automatically for audit.

Security Logging & Compliance

The page consolidates host, cloud-platform, and application evidence into centralized cloud logging. Under Cybersecurity Event Logs, each security-relevant source is confirmed as Covered once it is shipped to the logging pipeline — for example:

  • Host Audit Trail (auditd): Kernel-level syscall and command auditing that records privileged activity on the host.
  • Authentication & Access: Interactive and privileged access events across SSH, sudo, su, and PAM — the primary evidence for access-control assurance.
  • File Integrity Monitoring (FIM): Detection of unauthorized changes to sensitive files and system configuration, keyed by area (identity, privileged access, SSH, PAM, scheduled tasks, boot, network, and system binaries).

Fields marked as required must be captured for every event, so your logs meet forensic-grade completeness.

What the SIEM Plan Delivers​

Centralized Security Event Logging​

Security-relevant events are collected from every server and consolidated into a single, access-controlled platform, so you have one place to search, correlate, and investigate. Collected sources include:

  • Authentication and access events
  • Privileged and administrative activity
  • Host audit trails
  • Intrusion-prevention (IPS) events
  • Software and package changes
  • Network traffic and firewall activity

Bringing these together eliminates blind spots and makes cross-system investigation possible from one view.

File Integrity Monitoring (FIM)​

Real-time detection of unauthorized changes to critical files and directories, so tampering is caught the moment it happens. Monitored areas include:

  • Identity files
  • Privileged-access configuration
  • SSH configuration
  • Authentication files
  • Scheduled tasks
  • Boot configuration
  • System binaries

Every FIM event records the responsible user, the action taken, and the timestamp, so you know exactly who changed what and when.

Full-Detail Forensic Records​

Every event captures the complete context needed for investigation and accountability:

  • Date and time
  • User identity
  • Source
  • Affected system
  • Affected object
  • Outcome

This level of detail supports thorough incident investigation and clear accountability.

Tamper-Proof Retention (18+ Months)​

Logs are retained for a minimum of 18 months in an immutable, write-once (WORM) archive, so records cannot be altered or deleted. Retention safeguards include:

  • Write-once, read-many (WORM) storage
  • Retention lock to enforce the retention period
  • Role-based access control (RBAC)
  • Separation of duties

Together these controls preserve the integrity and admissibility of your records.

Real-Time Alerting​

Configurable alerts notify you the moment high-risk events occur, delivered to your chosen notification channels. Alertable events include:

  • File-integrity changes
  • Privileged logins
  • Audit-configuration changes
  • Network access events

Compliance Dashboard and Evidence Export​

A single dashboard gives you a clear view of your security logging program and the evidence auditors ask for:

  • Log coverage across systems
  • Log-format fields captured
  • Retention status
  • Alerts
  • Exportable evidence for audits

Built for Compliance​

The SIEM & Security Logging plan is designed to support regulatory frameworks, including the NCA Essential Cybersecurity Controls (ECC). It provides control-mapped evidence for event-log management and monitoring, so you can demonstrate that the required controls are in place and operating — turning day-to-day security logging into audit-ready proof.

Who Should Use It​

  • Organizations subject to regulatory or industry compliance requirements.
  • Teams that must retain security logs for extended periods in a tamper-proof form.
  • Businesses that need SOC-style centralized monitoring and real-time alerting.
  • Any Enterprise customer that needs to produce control-mapped evidence for audits.

Next Steps​