Agile and  Modern IT Solutions

Our client, a prominent crude oil refinery renowned for producing gasoline, jet fuel, diesel, heating oil, heavy fuel oils, propane, and asphalt for multinational corporations, recognised the need for enhanced insights and analytics derived from machine data and event logs. They set out to elevate these capabilities by implementing an automated response mechanism to improve operational efficiency and fortify security measures.

The client revolutionised their operational environment by harnessing the power of Splunk, a leading platform known for its robust big data analytics, monitoring capabilities, security features, and incident response tools. The customer unlocked invaluable insights through the strategic integration of Splunk across their infrastructure and the centralised aggregation of machine data, event logs, metrics, and network traces. These insights empowered them to optimise operational efficiencies, pre-emptively identify operational risks, thwart cybersecurity threats, and automate responses to promptly and efficiently counter known vulnerabilities.

Our customer encountered obstacles with visibility into their environment, leading to performance issues. They sought a comprehensive solution to gain a complete understanding of their network activities and address the performance challenges effectively.

We implemented a robust solution by utilizing Gigamon for monitoring network changes, performance evaluation, and traffic pattern analysis, along with Extrahop for advanced network analytics, thereby enhancing our network performance monitoring capabilities.

The client faced challenges in managing a high volume of security alerts (976+) across a mixed environment of 146 endpoints. Their infrastructure included a combination of Windows workstations, servers, VMware hosts, Office 365, and security tools like CrowdStrike EDR and Cisco Umbrella. Despite leveraging Arctic Wolf services for monitoring and alerting, they struggled to contextualize and prioritize alerts, evaluate risks, and efficiently remediate vulnerabilities. Additionally, undefined hardware details, complex configurations, and dependency risks added complexity to the remediation process.

Our team provided managed security services tailored to the client’s needs. We reviewed security alerts daily and conducted weekly sessions to contextualize findings, aligning priorities with their business requirements rather than generic industry standards. We assisted with risk assessment, provided pros and cons for mitigation options, and offered recommendations for configuration changes. By developing customized remediation plans and runbooks, we empowered the client to handle common issues effectively. Proactive measures included ensuring alignment with best practices, such as enabling MFA for AnyConnect users and addressing complex firmware risks.