A firewall sees every connection attempt. Whether that becomes an attack only becomes clear to someone who brings the events together and assesses them, including at night and at weekends. For this we work with our security partner NEOSEC.
NEOSEC
How it fits together
Firewall, IPS and VPN generate events: blocked connections, signature matches, logins.
Syslog, NetFlow and the Wazuh agent deliver the events to the NEOSEC SIEM.
Firewall events are linked with endpoint and network data and prioritised with AI support.
Depending on the level, NEOSEC reports, responds together with you or takes over around the clock.
XIEM® levels
Each higher level includes everything from the previous one. The difference lies in how much NEOSEC takes on for you.
Level 1
How do I start with structured monitoring?
NEOSEC sets up and runs the SIEM. Firewall, endpoint and network events are collected centrally and checked against proven rule sets.
Level 2
How do I get active support?
Managed detection and response: NEOSEC maintains the rule sets, assesses alerts and responds together with you along predefined paths.
Level 3
Who responds at night and at weekends?
Security operations centre around the clock. NEOSEC monitors, responds independently within agreed limits and documents every incident.
Around the levels
A structured assessment against the CIS Benchmarks, both technical and through interviews. The result is a report with a risk matrix based on the methodology of Germany’s Federal Office for Information Security (BSI) and prioritised measures. Sonar is the entry point for every level.
Continuous monitoring of what is visible and attackable about your company from the outside: open services, vulnerabilities, data leaks.
NIS2
| Requirement | Implementation |
|---|---|
| Document technical measures | configuration reports from OPNsense, network diagram and rule set |
| Demonstrate risk management | Security Assessment Sonar and regular analysis reports |
| Detect attacks | SIEM at NEOSEC with correlation and AI prioritisation |
| Respond to incidents | coordinated response, around the clock from level 3 |
| Meet reporting deadlines | support with the 24-hour and 72-hour notifications |
FAQ
No. NEOSEC sets up and runs the monitoring. You get access to the customer portal with status and reports.
Security-relevant events from the firewall and connected systems. We agree scope and retention in advance, and processing is governed by contract.
Yes. NEOSEC also monitors other firewalls, servers and endpoints. With OPNsense the connection is particularly simple, because the Wazuh agent is available as a plugin.
Contact
We plan the firewall, NEOSEC monitors it. One conversation, one concept.
