R6140 Cyber Security Managed SIEM

Requirements of the service: • Initial health assessment and configuration of the Council’s in-house Security Event and Incident Management (SIEM) solution (Microsoft Sentinel). • Secure log collection from both on-premises and cloud systems, with logs transmitted to an externally hosted intelligence platform for advanced threat analysis. • Adaptable detection policies, leveraging automated intelligence, supplier expertise, and council-provided threat intelligence. • Support for log ingestion from a wide range of infrastructure components, including Windows and Linux servers, firewalls, routers, Azure Active Directory, Microsoft Defender, and Office 365. • No disruption to business operations during implementation. • 24x7x365 managed SOC service with incident response capabilities and access to subject matter experts. • Endpoint detection and response (EDR / XDR) • Incident detection, analysis, response and escalation. • Threat intelligence and threat hunting. • Monthly executive risk reporting and KPIs. • Ongoing threat detection and investigation support, drawing on previous incident data. • Secure portal access for council staff to incident and management information, with all operational data and SOC personnel based in the UK and cleared to BPSS as a minimum. • Demonstrated security accreditations. • Full onboarding, deployment, and initial tuning of the solution, with clear cost breakdowns for setup.