Case Study · Systems & Integrations

Security monitoring From scattered security logs to verified alerts and dependable audit evidence

Partner project by Innowise

Project profile

CustomerNot named
PartnerInnowise
IndustryTechnology services

Challenge

A technology service provider runs an extensive IT landscape of workstations, servers, firewalls and identity systems. Security events sat in separate sources. At the same time, a large number of false positives made it harder to assess genuine threats. For the ISO 27001 audit there was no centrally usable view of the relevant logs.

Solution

Collecting and assessing

Innowise set up a dedicated Wazuh SIEM solution. It consolidates events from Active Directory, Entra ID and Windows and Linux systems, among other sources. Custom rules detect unauthorized access, permission changes and relevant interventions in the system configuration.

Verified alerts instead of an alert flood

SOC analysts review the alerts and remove false positives before confirmed incidents reach the internal IT team. Weekly and monthly reports document trends, severity levels and evidence. Operational remediation remains with the client.

From many log sources to a verified incident

Workstations: Windows / Linux → Wazuh SIEM: Rules & correlation; Servers & firewall: Security logs → Wazuh SIEM: Rules & correlation; Identity systems: AD / Entra ID → Wazuh SIEM: Rules & correlation; Wazuh SIEM: Rules & correlation → SOC review: Filter false positives; SOC review: Filter false positives → Internal IT: Resolve incidents; Wazuh SIEM: Rules & correlation → Audit evidence: Reports & logs.

Technologies

Wazuh SIEM / Indexer / Dashboard
Active Directory / Entra ID
Syslog-ng / Python

Results

The partner documentation states more than 90 % fewer false positives reaching the client. No deviations were found in the audited log monitoring requirements. That statement covers this audit area and is not a blanket certification or security guarantee.

Over 90 % fewer forwarded false positives
Central view of security events
Clear ownership of remediation