Eagle SOC Secure
The gateway in front of the SOC, and the other end of the tunnel.
Eagle SOC SecureThe firewall in front of the SIEM
The way out to the SOC, and the way in for the OT Sensor. No inbound port is opened.
What it does
The only way in or out
A SIEM holds the most revealing data an organisation has. Eagle SIEM Secure stands in front of it, and everything that enters or leaves passes through.
- One for every instance. Each customer's SIEM stands behind a firewall of its own.
- It dials out. An encrypted WireGuard tunnel is opened from the customer to Eagle SOC Secure. Nothing is opened inbound from the internet.
- Two names, with certificates. One address takes logs in and one serves the SIEM itself, both over HTTPS through Caddy.
- Syslog, taken in and passed on. Firewalls, switches and appliances that only speak syslog send to it, and it forwards to the SIEM.
- The way in for the OT Sensor. What the sensor sees of the industrial network reaches the SIEM through here and no other way.
- Known attackers turned away. CrowdSec refuses addresses with a record of attacking before they reach anything.
- Configured by generation. The firewall's configuration is generated for the instance on a hardening baseline, not typed by hand.
- Updates with a way back. Firmware updates are started from Eagle SOC, after a backup of the configuration, and a savepoint restores the previous state if the firewall does not come back as it should.
In the suite
Between the customer and the SOC
Eagle SIEM
The cluster that holds and searches the logs. It stands behind this firewall.
Eagle SIEMEagle OT Sensor
Listens to the industrial network, and reports through this firewall to Eagle SIEM.
Eagle OT Sensor
Eagle SecOps Suite
One part of one system
Eagle SIEM Secure is part of the Eagle SecOps Suite: governance, detection, monitoring, vulnerability scanning and secure DNS, built by one team to work as one.
See Eagle SIEM Secure running
An hour with the people who built it, on a real system, with your questions. No slideware.