Main Page

Logo NÚKIB

The National Cyber and Information Security Agency of the Czech Republic Co-Seals Publications on SIEM and SOAR Platforms with the Australian Signals Directorate and International Partners

The initiative includes collaboration with international partners such as the United States’ Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA) and Federal Bureau of Investigation (FBI), the Canadian Centre for Cyber Security (CCCS), the National Cyber Security Centre of New Zealand (NCSC-NZ), the United Kingdom’s National Cyber Security Centre (NCSC-UK), Japan’s National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and Japan Computer Emergency Response Team (JPCERT), the Republic of Korea’s National Intelligence Services (NIS), and Cyber Security Agency of Singapore (CSA).

The publication series consists of 3 publications:

  • Implementing SIEM and SOAR platforms – Executive guidance defines SIEM and SOAR platforms, explains their value and also their challenges, and provides high-level recommendations for implementing them. It is targeted at executives, but can be used by any organization that is considering whether and how to implement a SIEM and/or SOAR.
  • Implementing SIEM and SOAR platforms – Practitioner guidance provides high-level guidance for cyber security practitioners and describes how a SIEM/SOAR can enhance visibility, detection and response, as well as principles for procurement, establishment, and maintenance of those platforms.
  • Priority logs for SIEM ingestion: Practitioner guidance provides practitioners with detailed logging guidance for specific categories of log sources, such as from Endpoint Detection and Response tools, Windows/Linux operating systems, network devices, and Cloud deployments

“I am pleased that NÚKIB was able to contribute to the second co-sealed series of documents led by the ASD, particularly its focus on SIEM and SOAR platforms, technologies that are increasingly being adopted across the Czech Republic. The recommended principles reflect the long-standing security standards that NÚKIB has consistently promoted. It is essential for organisations to commit not only to initial investments in security technologies but also to continuous support for the people and processes that operate them. A SIEM or SOAR solution that is not ingesting relevant data, and is not actively monitored and tuned, is unlikely to detect or respond to threats effectively, “said Lukáš Kintr, Director of NÚKIB.

These publications demonstrate the collective effort of global partners to strengthen cybersecurity and protect critical infrastructure from evolving cyber threats. Read the publications here.