Case Study · Systems & Integrations

Telecom security Monitoring network and financial systems together

Partner project by Innowise

Project profile

CustomerNot named
PartnerInnowise
IndustryTelecommunications

Challenge

A nationwide telecommunications provider had to evaluate security data from routers, switching systems, databases and billing systems. SOX-related audits additionally required traceable access and changes to financially relevant systems. The internal engineering organization remained responsible for interventions in the infrastructure.

Solution

Evaluating large data volumes centrally

Innowise configured Wazuh SIEM with Kafka and OpenSearch to consolidate the distributed events. The rules address unauthorized access, unusual database activity and unapproved configuration changes, among other things.

Two outputs from the same event base

The SOC reviews critical alerts and passes confirmed incidents on to operations with context. Quarterly and annual reports prepare access, availability and internal controls for management and auditors.

One event base, two lines of responsibility

Telecom network: Routers / switches → Log processing: Kafka / OpenSearch; Financial systems: Billing / ERP → Log processing: Kafka / OpenSearch; Log processing: Kafka / OpenSearch → Wazuh & SOC: Detection / triage; Wazuh & SOC: Detection / triage → Operations team: Investigate & fix; Wazuh & SOC: Detection / triage → Management / audit: SOX evidence.

Technologies

Wazuh SIEM / XDR
Kafka / OpenSearch
Linux / Unix / Cisco / Juniper

Results

The partner documentation reports the review of high-priority events in under a minute and the processing of several gigabytes of security data per day. That describes triage, not the complete remediation of an incident. The audit evidence provided met the described audit expectations without control deficiencies.

Triage of high-priority events in under a minute
Several gigabytes of log data per day
Reports for operations and audit