Many businesses divide security responsibilities among system administrators, network administrators, and others rather than employing dedicated security personnel. Because it guarantees that there are devoted Security personnel, such as Security Analysts who are pursuing threats, keeping an eye on alerts and logs.

A co-managed model describes a collaboration where your servers, firewalls, and other system devices' logs are used for monitoring, threat analysis, and threat triage. We'll act as your "eyes on glass" while you act as our "hands-on devices."

The kind of firewall, IDS, IPS, EDR, and antivirus solutions you have in place will determine the kind and quantity of alerts that are generated. According to user and group activity, machine and share activity, network traffic and events, error and warning conditions, anomalous and suspicious events and correlations, etc.,

The length of time that data is stored is decided during contract negotiations; every business has different compliance requirements. Log storage is usually kept for 365 days (cold storage). You would work with a SOC Analyst to determine the time frame, user or machine affected, and type of log source for incidents where data needs to be retrieved (outside of the 10-day active index).