1. Requirements
1.1. business
1.1.1. full featured SIEM service
1.1.2. vulnerability scanning
1.1.3. security reporting
1.1.4. threat intelligence feed integration
1.1.5. optional SOC service integration
1.1.6. secure communication between customer site and central component
1.2. commercial
1.2.1. no capex payment model
1.2.2. free trial period
1.2.3. simple pricing model (logger charging must have same structure as SIEM)
1.2.4. short term contracts
1.3. technical
1.3.1. cloud based deployment (01.11.16)
1.3.2. automatic deployment with basic set of use cases (01.11.16)
1.3.3. easy self service device onboarding (for selected device types) (15.11.16)
1.3.4. cloud based multi tenant ESM server for SOC service (01.11.16)
1.3.5. customer self service reporting (multi tenant platform) (01.11.16)
1.3.6. interface for monthly EPS reporting (01.11.16)
1.3.7. (on-prem) connectors available as ESX images and for classic systems (01.11.16)
1.3.8. easy customer deployable software updates (01.12.16)
1.4. legal
1.4.1. GDPR
2. Operations
2.1. onbarding
2.1.1. Customer info
2.1.1.1. data input
2.1.1.2. format
2.1.1.3. validation
2.1.1.4. preprocessing
2.1.2. data needed
2.1.2.1. Customer name
2.1.2.2. target host/ip
2.1.2.3. basic asset model
2.1.3. SOC
2.1.3.1. MSSP Best Practices
2.1.3.2. Automate MSSP New Customer Deployment
2.1.3.3. Activate adjustments
2.1.3.4. platform provisioning
2.1.4. Customer environment
2.1.4.1. Collector deployment
2.1.4.2. device change mgmt
2.1.4.3. validation
2.2. operating
2.2.1. what services and offerings
2.2.2. different options
2.2.3. SOC vs SIEM
2.2.4. separate SOC vs other internal SOCs
2.2.5. customer support
2.2.6. platform updates
2.2.7. environment changes synchronisation
2.2.8. SIOC SOMM goals
2.3. decomissioning
2.3.1. data retention / legal
3. Ideas
3.1. Kafka - topic per customer
4. use cases
4.1. initial
4.1.1. Perimeter Monitoring
4.1.2. Network Monitoring
4.1.3. Security Reporting
4.1.4. SLA Reporting
4.1.5. Threat Intel
4.2. phase
4.2.1. User
4.2.2. Win
4.2.3. OS
4.3. future
4.3.1. app
4.3.2. db
4.3.3. custom business
4.3.4. advanced in depth
5. Architecture
5.1. sizing
5.1.1. initial
5.1.2. short term
5.1.3. long term
5.2. platform
5.2.1. baremetal
5.2.2. VM
5.2.3. docker/mezos
5.2.4. Win vs Linux
5.3. automation tools
5.4. ESM
5.4.1. single
5.4.2. multiple
5.4.3. MoM
5.4.4. grow from single to MoM
5.5. ADP
5.5.1. none
5.5.2. Logger per customer
5.5.3. Army of Loggers
5.5.4. Kafka
5.5.4.1. topic per customer
5.5.5. customer vs. SOC premise
5.6. collection
5.6.1. VM image
5.6.2. Win vs. Linux
5.6.3. initial syslog
5.6.4. ready for other connectors
5.6.5. who owns the image?
5.6.5.1. support
5.6.5.2. update
5.6.5.3. insider risk