1. Home
  2. Offer
  3. SIEM / SOC

Department · SIEM / SOC

SIEM / SOC

An integrated threat detection system: Wazuh, Graylog and Fortigate in one ecosystem.

Packages Let's talk

We combine deep endpoint analytics (Wazuh) with central log management and automation (Graylog) and a Fortigate NGFW. The result is a coherent SIEM/XDR ecosystem that turns passive protection into an active response model.

Wazuh acts as the “security brain” and Graylog as the log “logistics centre”, also handling non-security events: system errors, service starts and stops or application logs. It is a SOC foundation - full enterprise-class technology in an operating model that fits your budget, without paying for analyst time when nothing is happening.

  • File and process integrity monitoring (FIM) on every host
  • Central, normalised logs from servers, workstations and the firewall
  • Log enrichment: GeoIP, network segment (VLAN), readable event descriptions
  • Real-time correlation of firewall and endpoint events
  • Active Response: host isolation and automatic IP blocking on Fortigate
  • GDPR compliance reports generated from rule mapping

Packages

Deployment, integration and operations

We build the solution in stages. Wazuh is open source (no per-agent or data-volume fees) and Graylog Security is a subscription billed by log volume. The whole replaces separate EDR, SIEM and SOAR systems.

01

DEPLOYMENT

SIEM/XDR from design to training

Model
One-off project
Scale
e.g. 400 hosts, approx. 320 man-hours
Price
Individual quote

For whom

Organisations that want to replace scattered logs and after-the-fact reaction with real-time visibility.

Scope

  • Audit and architectureVLAN segmentation, virtual machine resources, GDPR-compliant data retention.
  • Infrastructure and SIEM coreLinux (Ubuntu/Debian), Wazuh Indexer, Manager and Dashboard, Graylog with MongoDB and Fluent-bit.
  • AgentsMass rollout to Windows and Linux (GPO, Ansible), FIM and vulnerability scanning modules.
  • Data enrichmentLookup Tables and Pipeline rules, e.g. EventID 4625 shown as “wrong password - finance department”.
  • Tuning and alertsCustom decoders, false-positive elimination, e-mail and Teams notifications.
  • TrainingGraylog dashboards (L1/L2) and critical incident response procedures.

The key stage

Noise reduction: we tune FIM, SCA and Vulnerability Detection rules so that the team receives only verified alerts.

Ask about this package
02

INTEGRATION

Fortigate NGFW and SOAR

Model
Deployment extension
Turnaround
3-5 business days
Price
Individual quote

For whom

Companies with an NGFW (e.g. Fortigate, Cisco Firepower) that want to correlate network traffic with endpoints and block attacks automatically.

Scope

  • NGFW eventsFortigate sends logs of blocked connections and detected IPS signatures to Graylog.
  • Parsing and risk scoringA Graylog Pipeline extracts the source address and assigns a Risk Score based on threat intelligence.
  • Endpoint correlationA host load spike reported by Wazuh that coincides with firewall traffic raises a critical alert.
  • Behavioural checkAutomatic check for anomalies, e.g. TCP SYN connection counts and ICMP traffic.
  • Automatic blockingA malicious IP is added to the Fortigate block list via API, without human intervention (Shuffle SOAR).

Result

Automation cuts the time from detection to notification from over ten minutes to tens of seconds.

Ask about this package
03

OPERATIONS

SOC foundation (L1-L3)

Model
Monthly flat fee
Licences
Wazuh free, Graylog subscription
Price
Individual quote

For whom

Organisations that need constant security oversight but do not need an analyst in front of a screen around the clock.

Scope

  • L1: automation and triageGraylog SOAR merges hundreds of alerts into one incident, procedures guide verification and an AI summary describes the attack.
  • L2: specialist analysisExamining attack patterns (e.g. TCP SYN Flood) and common botnet traits on analytics dashboards.
  • L3: hunting and Active ResponseProactive threat hunting in FIM logs, host isolation via wazuh-execd and IP blocking on the firewall.
  • ComplianceGDPR reports from Wazuh rule mapping and an evidential event history.

No idle time

You pay for oversight and response, not for analyst time spent in front of a screen when nothing is happening.

Ask about this package

Results

Before and after deployment

What an integrated detection system changes in day-to-day IT and security work.

AreaBeforeAfter
Detection time (MTTD)Days or weeks, after-the-fact reactionReal time: log correlation and XDR analytics
Visibility of file and process changesNoneFull control (wazuh-agentd, wazuh-syscheckd)
Log managementScattered, unreadable raw dataConsolidated and enriched with business context
Firewall under attackLoad peaks during traffic floodsRelieved thanks to Application Awareness
GDPR complianceManual evidence gatheringReports from rule mapping to GDPR articles

Architecture

Wazuh and Graylog working together

The hybrid model avoids compromises: each tool does what it does best.

Wazuh

  • Indexer and Server: central alert analytics (wazuh-analysisd).
  • Agents on every host: communication (wazuh-agentd) and selective event collection (wazuh-logcollector).
  • FIM, configuration assessment (SCA) and vulnerability detection.

Graylog

  • Data Adapters: importing external databases to enrich logs.
  • Lookup Tables: turning technical codes into readable descriptions.
  • Pipeline Rules: categorising events on the fly, before indexing.

Data flow

  • Ingest: Wazuh agents send endpoint logs and Fortigate sends network syslogs to Graylog.
  • Normalisation: a common field schema for JSON and Syslog.
  • Enrichment: GeoIP and the host’s network segment (VLAN).

How we work

Build stages

  1. 01

    Audit and design

    VLAN segmentation, VM resources (min. 16 GB RAM for the Indexer), GDPR retention. 1-2 days.

  2. 02

    Infrastructure

    Linux (Ubuntu/Debian), MongoDB for Graylog, Indexer for Wazuh. 2-3 days.

  3. 03

    SIEM core

    Wazuh Manager and Dashboard, Graylog as the analytics hub, Fluent-bit. 3-4 days.

  4. 04

    Agents

    Mass rollout to Windows and Linux workstations, FIM and vulnerability scanning. 2-4 days.

  5. 05

    Tuning and alerts

    Decoders, false-positive rules, e-mail and Teams alerts. 4-6 days.

  6. 06

    Integration and SOAR

    Optional: NGFW (Fortigate, Cisco Firepower) and Shuffle for automatic response. 3-5 days.

  7. 07

    Training

    Graylog dashboards (L1/L2) and critical incident response procedures. 1-2 days.

FAQ

Frequently asked questions

Services

Is this a full 24/7 SOC?

It does not have to be. A full SOC means analysts hunting threats around the clock. Our model is a SOC foundation: the system watches constantly and a human steps in when an alarm goes off. The lack of 24/7 analysis is offset by automatic response (Active Response) - the system can block an attacker’s IP or isolate a host before the team has time to react.

How much do the licences cost?

Wazuh is open source - no licence fees per agent or data volume. Graylog Security/Enterprise is a paid subscription billed by log volume (GB per day), required for SOAR, AI summaries and threat correlation. The whole replaces separate EDR, SIEM and SOAR solutions.

How long does deployment take?

It depends on the number of hosts and the integration scope. For example, a deployment for 400 hosts takes about 320 man-hours: from architecture design, through installation and agent rollout, to rule tuning and team training.

Does it help with GDPR and NIS2 compliance?

Yes. Wazuh rules are mapped to GDPR articles, which allows compliance reports, and central logging gives an evidential event history. The system also meets the continuous monitoring requirement of the Polish KSC act (Art. 8(1)(2)(g)).

Blog

Read more on the blog

Other departments

/ Contact

Let's talk about your infrastructure

The first conversation is free and non-binding. We donate the equivalent of the first hour of work with every new client to charity.

Contact us +48 787 000 449
E-mailbiuro@sysadvisors.pl
Phone+48 787 000 449
Krakówul. Marszałka Józefa Piłsudskiego 40/1a
Warsawul. Fortel 12
LinkedIn/company/sysadvisors