Network Security Services: SIEM, IDS, Firewall Audit & Compliance

Network Security: SIEM, IDS, Audit & Compliance

In nginx logs over three days — 2.3 million requests. Among them, 40 thousand from a single /24 range, pattern /admin, /wp-login, /.env, /config.php. A classic scanner — automatically blocked by fail2ban if it's configured. If not, requests simply go nowhere. But nearby, in the same logs, one line: a successful POST /api/v2/export with a session token created five minutes ago from an IP in the Netherlands, while the user always accesses from Moscow. fail2ban will not find that line. We are a team of certified security engineers with 10+ years of experience in network protection. Over the years we have developed a systematic approach: SIEM + IDS/IPS + compliance audit.

What problems we solve: from scanners to hidden leaks

Modern attacks are rarely straightforward. 70% of data exfiltration incidents involve API abuse (Verizon DBIR). We focus on three main vectors:

• Scanning and brute force — mass attacks on web applications (WordPress, Jenkins, GitLab). Handled by fail2ban, iptables, nginx limits. But if not configured — vulnerability on autopilot.
• Data exfiltration — API requests from unusual geolocations, atypical download volumes (e.g. 5 GB in 10 minutes by a single user). fail2ban will not see them; event correlation by user and behavior is needed.
• Internal host compromise — after phishing or exploit, the attacker gains access to rarely used servers. Logwatch or standard auditd will not trigger, but SIEM with FIM and anomaly rules does.

Why SIEM detects what fail2ban misses?

fail2ban analyzes the frequency of similar events — 5 failed logins per minute, 404s from one IP. This works against brute force. But if an attacker makes one request from different IPs (botnet) or uses a legitimate session (stolen token), fail2ban is useless. SIEM correlates events by different criteria: geolocation, time series, sequence of actions, traffic volume spikes. Wazuh with custom rules is a typical solution. Official Wazuh documentation (https://documentation.wazuh.com) provides many examples.

Wazuh SIEM: from installation to real benefit

Wazuh is not just an IDS. It is an SIEM with agents, file integrity monitoring (FIM), vulnerability detection and compliance checks in one stack: Wazuh Manager + Elasticsearch/OpenSearch + Kibana/OpenSearch Dashboards.

Architecture: Manager receives events from agents (Linux, Windows, macOS). Agents collect system logs (/var/log/auth.log, Windows Event Log), syscheck (file changes), rootcheck, and also perform active responses.

How to configure event correlation for anomaly detection?

Default Wazuh rules cover the obvious: SSH brute force, sudo escalation, changes to /etc/passwd. Real value is in custom rules tailored to application specifics. Example for detecting anomalous data export:

<rule id="100200" level="12"> <if_sid>31100</if_sid> <url>/api/v2/export</url> <description>Data export API called — potential exfiltration</description> <group>web,data_exfiltration</group> </rule> <rule id="100201" level="15"> <if_sid>100200</if_sid> <different_srcgeoip>yes</different_srcgeoip> <same_field>data.src_user</same_field> <timeframe>3600</timeframe> <description>Data export from unusual geolocation for this user</description> <group>web,data_exfiltration,anomaly</group> </rule> 

Rule 100201 will trigger if the same user makes a request to /api/v2/export from another country within an hour — correlation by user and geolocation.

FIM for critical directories with inotify (realtime="yes") records changes immediately, not on a schedule. report_changes="yes" for /etc will show diff directly in the alert.

Active Response — after 8 failed SSH attempts in 60 seconds, the IP is blocked via iptables for 10 minutes. Careful with the location: all parameter — it will block the IP on all agents at once, including production.

Case study: how a hidden scan was detected

In one project, fail2ban did not react to requests to /api/internal/status — there were only a few per hour. But Wazuh with a rule for a non-standard URI (not documented) and geolocation check sent an alert level 10. It turned out to be a bot from Southeast Asia looking for open endpoints. Blocking at the WAF level solved the problem.

Suricata IDS: configuring the network perimeter

Suricata is a high-performance IDS/IPS with multi-threading. It operates in passive (IDS) and inline (IPS) modes. Key configuration:

af-packet: - interface: eth0 threads: 4 cluster-id: 99 cluster-type: cluster_flow defrag: yes 

cluster_flow ensures all packets of the same TCP connection are processed by one thread — critical for correct TCP stream reassembly.

eve.json in JSON format is sent directly to Wazuh or Elasticsearch. Kibana's Security App works with it natively.

How do IDS/IPS performance and integration compare?

Suricata is 3-5 times more performant than Snort on the same hardware due to multi-threading and AF_PACKET support. The setup takes 3-5 days per perimeter.

Security audit: what we check systematically

A structured audit covers several layers:

• Vulnerability scanning — OpenVAS/Greenbone for network, Trivy for containers. trivy image --severity HIGH,CRITICAL nginx:latest in CI/CD blocks images with critical CVE before deployment.
• Compliance — lynis audit system gives hardening index and specific recommendations; CIS-CAT Pro provides detailed mapping to CIS Benchmarks with pass/fail for each item.
• Network audit — nmap -sV -sC -O --script vuln on the perimeter provides a snapshot of open ports, service versions, known vulnerabilities; --script ssl-enum-ciphers checks for weak cipher support.
• Cloud audit — ScoutSuite for AWS/GCP/Azure: open S3 buckets, security groups with 0.0.0.0/0, IAM users without MFA, unencrypted EBS.

Each client receives a report with found issues, their criticality, and a remediation plan.

How to prepare infrastructure for network audit?

Before the audit, gather a network diagram, list of all servers and services, information about which ports are exposed externally. This will speed up the work and reduce false positives. For example, if a server has Jenkins on port 8080, the scanner may mark it as potentially dangerous, but you know it — exclude it from the list. An audit without such information takes 30-40% more time.

Compliance: how to prepare for PCI DSS and ISO 27001?

Compliance is not just documents. The technical requirements of PCI DSS 4.0 include controls that need to be implemented in the infrastructure:

• Requirement 6.3.3: all components are updated — automatic scanning + patch management.
• Requirement 10.3: logs are protected from alteration — centralized log management with write-once storage.
• Requirement 8.3.6: MFA for all non-console administrative access.

Wazuh with the compliance module generates ready reports for PCI DSS, HIPAA, GDPR with mapping of alerts to specific requirements. According to PCI DSS 4.0 Self-Assessment Questionnaire, these controls are mandatory for cardholder data environments.

What is included in the work (deliverables)

We provide:

• Audit report — vulnerability list, criticality, recommendations.
• Working SIEM — installed and configured Wazuh with custom rules.
• Perimeter IDS — Suricata with Emerging Threats rules, integrated into the monitoring system.
• Documentation — architecture diagram, configurations, incident response runbook.
• Team training — how to read alerts, write rules, work with Kibana.
• Support — 2 weeks of post-project support.

Timeline and how cost is calculated

Cost is calculated individually after the audit. The average data breach cost, according to IBM Cost of a Data Breach Report, is over $4 million. Investment in security prevents that. Our clients typically save 30-50% on incident response costs after implementing SIEM. With 50+ completed security audits and 30+ SIEM deployments, we bring proven expertise.

Get a consultation on SIEM setup and network audit — we will objectively assess your infrastructure and propose an action plan. Contact us to schedule a security review.