Business Network Upgrade with SIEM Log Collection for Cyber Security Compliance in Southport
A Southport business needed its network upgraded for a cyber security compliance rule, with a SIEM server for centralised log collection.
The problem
The client had a compliance obligation that required central collection and retention of security logs from across their network. Their existing setup used unmanaged switches and a basic router that could not export logs in a usable way, so there was no single place to see sign-ins, firewall events or network changes. They needed the network hardware brought up to a standard that could feed a SIEM (Security Information and Event Management) server without disrupting day-to-day work.
Symptoms reported
- No central record of firewall, switch or authentication events
- Unmanaged switches with no logging or per-port visibility
- Router unable to forward syslog data to a collector
- Compliance requirement for log collection and retention not being met
- No easy way to investigate or prove what happened after a security event
Diagnosis process
Before recommending parts or a full reinstall, Karma Techs followed a practical diagnostic process to confirm the likely cause and reduce the risk of unnecessary work.
- Reviewed the compliance requirement to confirm which log sources needed to be captured
- Documented the existing rack, switching and internet connection
- Identified which devices could not produce or forward logs in their current state
- Confirmed the SIEM server's ingestion method and network placement
- Planned the hardware changes and a cutover with minimal downtime
Repair work completed
- Installed a managed firewall/gateway and managed switching in the wall-mounted rack
- Re-terminated and dressed the patch panel runs to the new switch for a clean, traceable layout
- Configured syslog forwarding from the firewall, switches and wireless to the SIEM server
- Separated the SIEM and management traffic onto its own network segment
- Verified each expected log source was arriving and being parsed by the SIEM
- Documented the new layout, addressing and log sources for the client's records
Outcome
The business now has a managed network that forwards security and event logs to a central SIEM server, satisfying the compliance requirement. Staff work exactly as before, but there is now a single, retained record of firewall, switch, wireless and sign-in activity that can be searched and reported on if anything needs to be investigated.
Questions about this type of repair
What is a SIEM server and why would a business need one?
A SIEM (Security Information and Event Management) server collects logs from your firewall, switches, servers and sign-in systems into one place, so security events can be searched, alerted on and kept for a set retention period. Many cyber security frameworks and insurance or client contracts now require this kind of central logging.
Do you have to replace all the network hardware to send logs to a SIEM?
Not always, but unmanaged switches and basic routers usually cannot produce useful logs. Upgrading to managed switching and a managed firewall is the practical way to get complete, reliable log data into a SIEM.
Can a network upgrade like this be done without downtime?
Most of the work is prepared in advance and the changeover is scheduled for a quiet period. There is normally only a short, planned interruption while the new firewall and switching are cut over.
