Novacoast Orange
google_cloud_logo
Chronicle_Cloud_logo

Novacoast Security Services

Managed Security Services Utilizing Chronicle

Novacoast + Chronicle Partnership

Novacoast is an international security services company that helps organizations find, create, and implement solutions for a powerful security posture. This is achieved through advisory, engineering, development, and managed services. With more than two decades of experience, we've built our organization on a foundation of engineering expertise and a culture of creative problem solving.

Our managed security services come packaged with Chronicle and other security solutions to deliver an all-in-one combination of industry-leading tools and services. Our background and expertise allow us to offer SIEM design and architecture, external data source integration, reporting, custom Chronicle parsers, and Chronicle deployment services to enhance Chronicle to fit your unique business needs.


Chronicle Services

Novacoast has the cybersecurity, development, and management expertise to mature your Chronicle solution. Our global network of SOCs is staffed with experienced analysts who provide 24/7 monitoring and response, with threat hunting, EDR/NDR integration and kick-start services. View our different managed Chronicle service offerings below:

 

SOC Management & Chronicle Licensing

Kickstart with Annual Chronicle Licensing

Threat Hunting with Chronicle and Tanium Licensing 
Provisioning  
Log Source Review  
Infrastructure Design Preliminary Design Meeting Preliminary Design Meeting Preliminary Design Meeting 
Ingestion Infrastructure Setup  
Log Source Onboarding:
(Microsoft, EDR, Proxy, PAN Firewall, DHCP, Threat Intelligence)		 Limited to 5 Log Sources
Use Case Development  
Custom Parsing Supplemental Engineering Required Supplemental Engineering Required Supplemental Engineering Required
Threat Hunting 
(Hypothesis and Threat Hunt Creation)		    
Critical Alert
(24/7/365 Monitoring with Chronicle)		    
Reporting and Dashboards  
Support  

 

Chronicle Managed Services (SOC Services)
Five 24/7 SOCs Globally 

Analyst Tasks Include:
Hours: 24/7

  • Active incident and alert investigation
  • False positive handling
  • Incident tracking
  • Remediation support of incidents/events
  • Rule tuning
  • Build/tune Chronicle Detect custom rules/alerts
  • Escalation of incidents to customer staff
  • Participation in management reporting and planning meetings

 

Reporting and Service Review:
Monthly

  • Incident summary and review
  • Service questions and issues
  • Platform maturity and recommendations

Chronicle Parser Development

Chronicle has a set of out-of-the-box supported (OOB) log sources with pre-written parsers. These OOB sources are not subject to the three tiers listed below. For data sources without pre-written parsers, Novacoast offers three tiers of Log Source Onboarding, each of which is defined below. Parser development services are delivered by Novacoast Engineers and Developers who are assigned full-time or part-time to work on log source onboarding for each customers timeline and availability.

PARSING SUPPORT (Engineer/Developer Rates Apply)

Standard

 Intermediate Complex
1 day per log source  1-2 weeks per log source Up to 4 weeks for complex log sources

Basic parsing of fields such as event date, source IP, destination IP, etc.

 Work with customer to understand use cases for the selected log source.

Develop parsers for the subset of events required for the identified use cases

Work with customer to understand use cases for the selected log source.

Develop parsers for the subset of events required for the identified use cases



Threat Hunting with Tanium

Analyst Tasks Include:
Hours: 24/7

  • Alert/watchlist tuning
  • Hunt hypothesis creation
  • Intelligence driven
  • Customer centric contextual information
  • Active hunting in customer environment
  • Escalation of discovered incidents as needed

Reporting and Service Review:
Monthly

  • Threat Hunting Activity Review
  • Recommendations to SOC team for detection rules based on hunt findings
  • Service Questions and Issues Review
  • Platform Maturity and Recommendations
  • Feed tuning and recommendations

Critical Alert Monitoring with Chronicle

Analyst Tasks Include:
Hours: 24/7

  • Active Incident and Alert Investigation of Tanium Threat
    Response Alerts
  • False Positive Handling for Tanium P1 events
  • Escalation of Tanium P1 Incidents to Customer Staff
  • Maintain Security Runbook for Tanium Threat Response Alerts
  • Active hunting in customer environment


Reporting and Service Review:
Monthly

  • Incident Summary and Review
  • Service Questions and Issues

For more information on any of the above services details, please fill out the form below.

Request More Information From Novacoast

301 N Main St Suite 2100 and 2200
Wichita, KS 67202