Managed SIEM Services Built on Wazuh

Key Takeaways

• A SIEM collects security logs from your devices, servers, cloud apps and network equipment, and raises alerts from them in one place.
• BastionX is a Wazuh Gold partner and runs Wazuh for each client. Wazuh is open source, so there are no per-event or per-GB licence fees.
• We deploy and tune Wazuh, and our SOC investigates the alerts it raises.
• Up to 90 days of events stay searchable in the live system. Longer retention is set per client to match their obligations.
• The SIEM produces evidence for HIPAA, NYDFS Part 500, PCI DSS and SOC 2. It does not make a firm compliant.

What Is Managed SIEM?

SIEM stands for security information and event management. A SIEM collects logs from your endpoints, servers, cloud applications, firewalls and switches. It correlates those events against detection rules, raises alerts when something matches, and keeps a searchable record of what happened.

A managed SIEM service means a provider runs the SIEM for you. The provider deploys the platform, connects your log sources, writes and adjusts the detection rules, watches the alerts and maintains the system as your environment changes. You get the monitoring, the alerts and the reports without operating the platform yourself. That arrangement is also called SIEM as a service.

A SIEM and a SOC are different things. The SIEM is the system that collects logs and flags events. The SOC, or security operations center, is the team that reviews those alerts, decides which ones are real and responds. A SIEM with nobody reviewing its alerts produces a record that nobody acts on. BastionX's managed SIEM includes both: the Wazuh platform and the SOC analysts who work its alerts.

Why an Untuned SIEM Creates Noise

A SIEM installed with default rules raises alerts for activity that is normal in your business. Scheduled tasks, staff signing in from home and routine admin changes can all trigger alerts. When a queue fills with low-value alerts, the one that matters is easy to miss.

Tuning is the work of adjusting rules and thresholds to your environment. We set the countries your staff normally sign in from, add exceptions for approved travel and VPN services, and match rules to the systems you run. A rule that flags every overseas sign-in is noisy. A rule that flags a successful sign-in from a country outside your expected list, with no approved travel or VPN to explain it, is worth an analyst's time. Tuning continues for the life of the service, because your systems and staff change.

A managed SIEM also closes gaps that are common in environments without one:

• Logs stay in separate systems, so nobody sees events side by side.
• Nobody is alerted when critical files or configurations change.
• Known vulnerabilities in installed software go untracked.
• Alerts fire, but no automatic action follows.

Why BastionX Runs Wazuh

BastionX is a Wazuh Gold partner. Wazuh is an open source security platform with SIEM capabilities.

Many commercial SIEMs charge by the volume of events or data they ingest, so the bill grows each time you add a log source. Wazuh has no per-event or per-GB licence fees. We can connect your firewalls, switches, servers, laptops and cloud accounts without each new source raising your licence cost.

Your log data belongs to you. Because Wazuh is open source, your logs and records are not tied to one vendor's licence, and the detection rules can be read and explained to an auditor.

What's Included

• Log collection and analysis. Endpoints, servers, network devices and applications send their logs to Wazuh for correlation and alerting.
• File integrity monitoring. Wazuh alerts when critical files or system settings change unexpectedly.
• Configuration checks. Systems are checked against CIS-based hardening policies, and settings that drift from them are flagged.
• IT hygiene and vulnerability detection. Wazuh keeps a software inventory for each device and matches it against known vulnerabilities. This is separate from the automated internal vulnerability scanning run by the Bastion Core device.
• Microsoft 365, Google Workspace and cloud monitoring. We collect sign-in and audit activity, including Microsoft Entra ID sign-in logs.
• Automated response. Where agreed with you, Wazuh can take set actions on its own, such as blocking a source address or disabling an account.
• MITRE ATT&CK mapping. Alerts show the MITRE ATT&CK technique involved, so analysts and your team can see what an attacker was trying to do.
• Compliance mapping and reports. Alerts and records are tagged to the requirements they support, and we report on them regularly.
• Bastion Core log relay. When configured, the Bastion Core can act as a local relay, forwarding supported device data to the SIEM over an encrypted connection.
• Managed EDR. Our managed EDR, built on SentinelOne, runs alongside the SIEM on the endpoints covered by the engagement.

How BastionX Delivers Managed SIEM

Every engagement follows the same five steps.

1. Scope. We list your systems and log sources, agree how long logs must be kept, and note the regulations and frameworks that apply to you.
2. Deploy. We install Wazuh agents on endpoints and servers and connect sources such as Microsoft 365, Google Workspace, firewalls and switches. We check that each source is reporting before tuning starts.
3. Tune. We adjust rules and alerts to your users, locations and systems.
4. Monitor and respond. Our SOC analysts review alerts, investigate them and respond. Automated actions run where you have agreed to them.
5. Report. You receive regular reports on alerts, investigations and control status, and the records your auditors ask for.

Log Retention and Compliance Evidence

Up to 90 days of events stay searchable in the live system. Older logs are archived for as long as your obligations and policies call for. We agree the retention period with you at the start of the engagement.

Retention rules differ by regulation:

• NYDFS Part 500. Section 500.6(b) requires covered entities to keep cybersecurity audit trails for at least three years, and records used to reconstruct material financial transactions for at least five years. Firms using the §500.19(a) limited exemption are excused from §500.6. For financial clients we keep SIEM logs for five years.
• PCI DSS. Requirement 10.5.1 of PCI DSS v4.0.1 requires 12 months of audit log history, with the most recent three months immediately available for analysis.
• HIPAA. The Security Rule does not set a retention period for audit logs. 45 CFR 164.316(b)(2) requires required documentation to be kept for six years. For healthcare clients we keep SIEM logs for seven years.

Some rules require the outcomes a SIEM delivers without naming a SIEM. NYDFS §500.14(b) requires Class A companies to implement centralized logging and security event alerting, unless their CISO approves equivalent or more secure compensating controls in writing. HIPAA 45 CFR 164.312(b) requires audit controls that record and examine activity in systems that contain electronic protected health information. A SIEM is how BastionX meets these requirements. It is an implementation choice.

Wazuh includes built-in compliance mappings for PCI DSS, HIPAA, NIST 800-53 and SOC 2 Trust Services Criteria. They help tag alerts and records to specific requirements. They support your evidence, and your firm stays responsible for its compliance program.

Audits and formal assessments are performed by PKF O'Connor Davies (PKFOD) or your chosen auditor. BastionX provides the technical evidence and maintains the controls. Our cybersecurity compliance services cover the wider program, including HIPAA compliant IT services and NYDFS Part 500 compliance.

Who Managed SIEM Is For

Our managed SIEM clients are organizations in New York and New Jersey that need security monitoring and audit evidence but don't have their own security operations team. They include financial services firms, healthcare and dental practices, professional services firms, property management companies and event businesses.

It also suits organizations that want monitoring from the people who run their IT. When BastionX already manages your laptops, Microsoft 365 or Google Workspace, and network, adding managed SIEM means the same team watches the logs from those systems.

From the Field

Rashid Ahmed, CISSP, CISO & CTO

A finance employee at one of our clients signs in to Microsoft 365 from the New York office or from home. During routine monitoring, our SOC received a Wazuh alert: a successful sign-in to that account from an unfamiliar overseas IP address.

We had set Wazuh to collect Microsoft Entra ID sign-in logs and flag successful sign-ins from outside the client's expected countries, with exceptions for approved travel and VPN services. This one matched none of them. The employee confirmed they were in New York and not using a VPN.

The sign-in records showed MFA had been satisfied by an existing token. That happens in normal use, but alongside an unexplained overseas connection it needed a closer look. The Microsoft 365 audit log showed a new inbox rule that moved one vendor's messages to the Archive folder and marked them as read. The employee hadn't created it.

The employee then remembered opening a shared-document email and completing what looked like a Microsoft sign-in, MFA prompt included. The email and browser history led us to a phishing site that relayed the login to Microsoft and captured the session cookie. Matching session IDs across the sign-in and mailbox records tied the unauthorized activity to that session.

We blocked sign-ins, revoked the user's sessions, reset the password and removed the inbox rule. We reviewed the audit records to scope the access and kept monitoring before restoring access. Wazuh raised the first warning, and our analysts' investigation connected it to the phishing email and the stolen session.

One Team for IT and Security

BastionX runs managed IT and cybersecurity with one New York City team. The people who manage your endpoints, Microsoft 365 and network are the people reading your SIEM alerts, so they know what normal activity looks like in your environment. When an alert needs a fix, such as removing a stale account or patching a server, the same team makes the change and records it.

When you choose managed IT and cybersecurity together, your Bastion Core security device is included at no additional cost, as specified in your proposal.

Frequently Asked Questions

What is the difference between a SIEM and a SOC?

A SIEM is software that collects logs, correlates events and raises alerts. A SOC is the team of analysts who review those alerts, decide which are real threats and respond. BastionX's managed SIEM includes both.

Why does BastionX use Wazuh instead of a commercial SIEM?

Wazuh is open source, so there are no per-event or per-GB licence fees and adding log sources doesn't raise a licence bill. Your records aren't tied to one vendor's licence, and the detection rules can be read and explained. BastionX is a Wazuh Gold partner.

Who owns the log data?

You do. Your logs belong to your organization during and after the engagement.

How long are logs kept?

Up to 90 days of events stay searchable in the live system. Older logs are archived for as long as your obligations require. NYDFS Part 500 requires covered entities to keep cybersecurity audit trails for at least three years, and we keep financial clients' SIEM logs for five. PCI DSS requires 12 months of log history. HIPAA doesn't set a period for audit logs, so we keep healthcare clients' logs for seven years, longer than the six years HIPAA requires for compliance documentation. We agree retention with you at the start.

Does a SIEM make us compliant with HIPAA or NYDFS?

No. A SIEM supports the monitoring and evidence those rules call for, and your firm keeps responsibility for compliance. Audits and assessments are performed by PKFOD or your chosen auditor, not by BastionX.

Can you move us from our current SIEM?

Yes. We can plan and run the move, including reconnecting your log sources and rebuilding the detection rules you rely on.

How is managed SIEM priced?

Pricing depends on the number of devices and log sources, the retention period you need and the scope of monitoring. Wazuh adds no per-event licence fees.

Who responds when the SIEM raises an alert?

Our SOC analysts review and investigate the alert, then respond. Automated actions, such as disabling an account, run where you have agreed to them.

How We Researched This Guide

This page draws on Wazuh documentation, the text of 23 NYCRR 500.6 and 500.14, the HIPAA Security Rule at 45 CFR 164.312(b) and 164.316(b)(2), and PCI DSS v4.0.1 Requirement 10.

The service sections describe how BastionX deploys, tunes and monitors Wazuh for its clients. The page separates regulatory requirements from implementation choices such as a SIEM or a SOC. It was reviewed by Rashid Ahmed, CISSP.