Documentation contents
AarSOC · How it runs
What we collect
The sources AarSOC ingests, through agents or from your SIEM, how logs are normalised, and what we do not keep.
On this page
Through the agent
Our collection agent, installed on each machine, sends its security events to our collection servers, through your organisation’s tunnel.
- Linux and Windows systems: system logs, Sysmon, file integrity, inventory, vulnerabilities.
- Application logs read locally: syslog, JSON, Windows event logs.
Through the network
Network collectors (intrusion detection sensor and other network sources), authenticated with a client certificate (mutual TLS). The on-site collector with network detection is part of the Gardien offer.
From your existing tool
- By API: alerts from Wazuh, Elastic Security, Splunk, IBM QRadar, Microsoft Sentinel, Graylog and OpenSearch.
- By direct read from an Elastic, OpenSearch or Wazuh.
We have no network syslog receiver: a network device is collected by an agent or a relay that reads its logs.
Normalisation
- The decoders of our detection engine extract the fields (timestamp, host, user, addresses, event identifier), then rules qualify the event.
- The alert is enriched with a geolocation of public addresses, computed on our servers (DB-IP database refreshed monthly, no call to an external service).
- It is stored in your organisation’s indices.
- Alerts received from a third-party SIEM are converted to a common schema before storage.
An application with a proprietary format
We write a decoder and rules for our detection engine from a sample of your logs. The time needed depends on the format and its documentation. Sources identified during scoping are part of the initial scope; those discovered after start-up are covered by a contract amendment.
Volume
The platform applies no volume cap and never truncates your data. The covered scope (machines and sources) is defined in the contract; extending it is done by amendment.
What we do not keep
Raw logs that trigger no rule.