Introduction to Kaseya SIEM

Overview

The Kaseya SIEM (Security Information and Event Management) platform is set to transform how organizations handle and respond to security incidents, marking a pivotal development in cybersecurity monitoring. SIEM technology collects and analyzes security data from an organization's environment, helping identify threats and enabling faster and more effective responses. Kaseya SIEM is designed specifically for Managed Service Providers (MSPs) and Small to Medium-sized Businesses (SMBs), while also being uniquely configured for Kaseya customers. This comprehensive solution integrates features from both RocketCyber and SaaS Alerts, leveraging their combined strengths to address cybersecurity challenges with unmatched efficiency.

The vision behind Kaseya SIEM

Kaseya SIEM emphasizes the synergies between RocketCyber and SaaS Alerts, both of which handle security data management but in different ways. RocketCyber focuses on alerting users through a Security Operations Center (SOC) when potential issues arise, while SaaS Alerts uses automated rules to perform actions in response to recognized threats. By merging these two systems, Kaseya SIEM serves as a fully managed solution that offers continuous oversight and optimization. This integration not only alerts users but also automates responses to security incidents, thereby enhancing operational efficiency as follows:

• Automated rules and actions: The automation engine in Kaseya SIEM allows for a trigger-and-action response mechanism. For example, if a virus is detected through Endpoint Detection and Response (EDR), the platform can automatically lock the corresponding Microsoft account and isolate the affected device.
• RocketCyber 24/7 monitoring: Combining automated detection and response with the expertise of RocketCyber's SOC provides robust, real-time alerting, investigation, validation, and response. This approach eliminates the burden of around-the-clock monitoring. For instance, if a user logs in from an unusual location, the SOC will notify the point of contact to investigate further, ensuring a rapid response to potential threats. This enables small IT teams to concentrate on their core responsibilities while enhancing security and reducing manual oversight.

Kaseya SIEM version 1.0 (limited release)

Kaseya SIEM is launching a limited release version 1.0 with the primary goal of learning from user feedback and refining the system, rather than merely focusing on achieving widespread adoption. The main priority for this release is the integration of RocketCyber data into SaaS Alerts, which will provide users with a unified interface for monitoring activities across multiple connected products. This integration aims to enhance user capabilities through the following features:

• Strengthened monitoring: Kaseya SIEM enhances monitoring capabilities by offering access to an expansive pool of over 60 monitored cybersecurity data sources. This includes more than 40 product integrations from RocketCyber and an additional 20 from SaaS Alerts. With this augmented coverage, organizations can detect, prioritize, and respond to threats in real-time more effectively.

• Comprehensive data access: Users will have access to up to 400 days of historical data, a significant increase from the current 35 days offered by RocketCyber. This extensive data retention will help organizations analyze patterns and detect anomalies over a longer timeline and across different applications, including Microsoft 365 and EDR.
• Enhanced user visibility: The ability to view a single user's activity across multiple platforms in a consolidated manner offers a comprehensive insight into security events. This cross-correlation feature has been highly requested and will enable users to better understand user behavior and identify potential threats.
• Device isolation capabilities: The introduction of an automation engine allows for a streamlined trigger-and-action mechanism. This enables users to isolate a device if specific actions are detected. For example, if suspicious behavior is detected linked to Microsoft accounts, the system can automatically initiate isolation of the corresponding devices via Datto EDR. The device isolation feature will be enabled automatically by default.
• Indicators of compromise (IoCs): Kaseya SIEM will support the creation of custom events, allowing threat hunters to establish IoCs based on a combination of triggers across different platforms. This functionality not only enhances threat detection but also provides a mechanism for MSPs to share findings with the community once validated. Upon approval, these strategies can be disseminated widely, strengthening the collective defense against emerging threats.

The Kaseya SIEM 1.0 limited version marks a significant step forward, focusing on immediate user needs while establishing a framework for ongoing learning and adaptation. Future iterations will lead to developing a standalone application that will offer a unified and customizable user experience through a single dashboard that displays security events, facilitates automated responses, and integrates seamlessly with the PSA tools our customers already depend on.

Getting started with Kaseya SIEM 1.0

BEFORE YOU BEGIN  Participation in the limited release of Kaseya SIEM 1.0 is restricted to the first 500 managed service providers (MSPs) that sign up. To qualify, MSPs must be subscribed to K365 Endpoint Pro and K365 User, and they must enroll a minimum of 100 users. The number of contracted users will be based on the smaller figure between the number of endpoints on Endpoint Pro and the number of users on K365 User. This limited release will be a month-to-month offering.

We’re excited to help you get started on your journey to enhanced security and insights. Here’s what you can expect as you begin:

• Registration process: Account managers will complete the Kaseya SIEM Registration form on your behalf.
• Approval notification: Once your registration is approved, you will receive a welcome email. This email is important as it confirms your access to the limited release of Kaseya SIEM 1.0. Please note that approval is manual; if your registration is not approved, you will be placed on the waitlist.
• Welcome email details: In your welcome email, you will find confirmation of your approval and access to the Kaseya SIEM Onboarding Checklist. This checklist will guide you through everything you need to know to start using the system effectively. The Kaseya SIEM Onboarding Checklist presents two options for onboarding to fit your preferences:
  • Start onboarding: If you prefer to learn at your own pace, this option lets you follow the provided checklist and access links to knowledge base articles without direct assistance.
  • Schedule Professional Onboarding: For those who would like a more hands-on approach, select this option to work with a Kaseya representative who will guide you through the onboarding checklist, ensuring you have everything set up correctly.

    

We encourage you to choose the onboarding method that best suits your needs and begin exploring the capabilities of Kaseya SIEM 1.0.

Kaseya SIEM Onboarding Checklist

The Kaseya SIEM Onboarding Checklist serves as a step-by-step guide outlining essential tasks and considerations necessary for successfully deploying Kaseya's SIEM capabilities.

• In Step 1, enter the onboarding code provided to you, unless it is already filled out. If you need help, please contact your account manager. To proceed, click Next.

  

• In Step 2, some of your information will be already pre-filled. Completing the rest of your personal information is optional. However, you must indicate whether you use any PSA or RMM systems. If you select Yes, a dropdown menu will appear for you to select the appropriate tool you are using. Additionally, you will need to specify whether or not you use Datto EDR. Click Next to move to the next page.

  

• In Step 3, confirm that all items on the SaaS Alerts Checklist have been completed. Please select the checkbox next to each completed item listed below:

• After completing the onboarding checklist in SaaS Alerts, click Next to proceed to Step 4: Completing the RocketCyber Checklist. Below is the description for each checklist item:

• Finally, click Submit and you will be contacted shortly.

The Kaseya SIEM Checklist offers a detailed framework for deploying a SIEM solution and emphasizes the importance of proactive security measures in today's digital landscape. By following this checklist thoroughly, organizations can effectively implement the capabilities of Kaseya SIEM, enhancing their security monitoring and incident response processes. Each step is essential in building a robust security infrastructure to defend against evolving cyber threats.

Establishing connection with RocketCyber

Once you have signed up for Kaseya SIEM, you will be recognized in our database as a SIEM client. One of the most important items in the Kaseya SIEM Checklist is to establish a connection with RocketCyber in SaaS Alerts for the organization of your choice (RocketCyber can only be attached once per tenant). To accomplish this, follow these steps:

• Click Organizations in the left pane.

  

• Click the edit organization icon for the organization you want to connect.

  

• Click + New Application. If the organization already has other connected applications, you will see the + New Application button on the right. If there are no connected apps for the organization, you will also find the button in the center of the page.

  

• Make sure the I have customer's global admin credentials option is selected.

  

• Scroll down to the bottom of the page, where you will find the option to enable the connection with RocketCyber. Click the tile to proceed.

  

• After clicking, you will be directed to the RocketCyber Connection Wizard. Please follow these steps:
  • Set Credentials: This is the first step of the wizard. You will see two items:
    • RocketCyber Region: You will see your RocketCyber region displayed. Please make sure that the RocketCyber and SaaS Alerts regions match.
    • API Token: Enter your RocketCyber API token to establish an API connection. If you need assistance accessing your RocketCyber API token, please refer to this article. You can click the eye icon to temporarily unmask the token for verification. Once you’ve entered the token, click Next to continue.
    Once the application connection is successful, a confirmation message will appear in the upper-right corner.

    

  • Product Selection: In Step 2 of the wizard, you will complete the Product Selection section. This is where you can choose from a range of products available for activation. This area serves as the global control panel, allowing you to enable various functionalities:
    • Under Available Products, select the checkboxes for the products you want to activate—typically, those that the partner will use for the vast majority of their organizations—and click + Add.

      

    • The products you select will then appear under Globally Assigned.

      

    • Here, you also have the option to select the checkbox next to a product and click Remove.

      

    • A warning message will pop up, informing you that removing a product means it will be taken off the global product list for all organizations using it, but it will not be removed from organizations that have a custom product list. Please choose either Cancel or Confirm.

      

    • Next, you can set the default state of these products for each organization. By default, the products are turned off, which means they can be connected but are not actively monitored. As a result, these products will not be displayed in the application list, but they will be available to connect when clicking + New Application. When you toggle a product on, the switch will turn green, indicating that the product is assigned and its monitoring will start once you map the organization in the next step. This information also applies to the toggles on the Organization Mapping screen. Finally, click Apply & Continue Editing or Next to proceed.

      

  • Organization Mapping: Additionally, there is an option to map customers from SaaS Alerts to RocketCyber:
    • Click the dropdown menu under SAAS ALERTS ORG to select the appropriate organization.

      

    • In the event that a new SaaS Alerts organization needs to be created, the system allows for a straightforward command (Create) to facilitate this process. Alternatively, if it is determined that a SaaS Alerts organization will not be utilized, there is an option to disregard it (Ignore), which will then move the organization to the designated Ignored tab.

      

    • Once you choose a SaaS Alerts organization, you can decide whether to enable certain features for specific clients. By default, the toggle in the middle is displayed in gray, indicating that the organization is currently using globally assigned apps.

      

    • To activate the toggle, simply slide it until it turns green. This indicates that you are no longer using the global list you previously established, nor are you applying the global toggle settings. Instead, you can start from the base settings and customize as needed. Everything you do here will now be specific to this particular organization.

      

    • Next, click Apply and Map to apply organization mapping, product assignments, and their activation statuses.

      

    • The organization will then be moved to the Mapped tab. Click Apply & Continue Editing to save your current mapping selections and continue making additional changes in the Organization Mapping screen, or click Finish to complete the organization mapping process and exit the wizard, saving all changes.

      

    • If you need to adjust your connection to RocketCyber, just click the RocketCyber tile and then select Edit in the lower-right corner. You will be taken to Step 2 (Product Selection) of the RocketCyber Connection Wizard.

      

    • To disconnect from RocketCyber, click the RocketCyber tile and select Disconnect Application. Deleting the application connection will keep the historical data will remain on the platform. Once you disconnect, data imports will stop, and the organization will no longer contribute to your billable count.

      

    • A Delete App pop-up message will ask you to confirm the deletion of the application or to Cancel.

      

    Customer apps

    After completing the RocketCyber Connection Wizard, the Customer Apps section will be visible. Essentially, these applications extract information from RocketCyber and integrate it into SaaS Alerts, providing a significant advantage as SaaS Alerts operates more quickly and efficiently.

    

    For instance, in the area of event data filtering, Kaseya SIEM offers the capability to filter and search for event data within SaaS Alerts. This feature enhances data management and allows for faster identification of relevant information when compared to RocketCyber. To use this feature, click Analysis in the left pane. From there, you can select appropriate filters and click Run Report.

    

    In SaaS Alerts, you can filter and search for data similarly to how you would in RocketCyber, but a significant advantage is the ability to set up indicators of compromise.

    Indicators of Compromise

    Indicators of compromise allow you to create rules that monitor various applications for specific event data. You can see a list of different events available for searching and filtering. To do so, click Indicators of Compromise in the left pane.

    

    This setup allows you to establish your own alerts and notifications when certain events occur. In contrast, RocketCyber primarily controlled what data was deemed important, which may not have aligned with your specific needs. With SaaS Alerts, you can define what alerts you want to receive when particular situations arise. Additionally, these indicators of compromise will be automatically added to clients’ platforms. Potential threats will be identified and relevant indicators will be set up for them. Moreover, response rules are created, and they enable your system to take action if these indicators are triggered. For detailed information on Indicators of Compromise, refer to our Help article.

    Response rules

    We will push out effective response rules to Kaseya SIEM clients automatically, focusing on detecting malicious activity. Instead of overwhelming Kaseya SOC with numerous events—potentially millions—our system allows clients to filter and curate these events through our indicators of compromise. This ensures they only receive events that matter to them, making their response efforts more efficient. Furthermore, our automation will support this process. If our system identifies malicious activity, it can take action without waiting for manual approval. For more information, refer to The Respond module.

    

    This automation is one of the significant benefits of using a security information management (SIEM) system and running RocketCyber through SaaS Alerts.

    Conclusion

    In summary, successfully integrating RocketCyber in SaaS Alerts is a crucial step that significantly enhances your organization's cybersecurity strategy. This integration enables a more efficient and streamlined approach to monitoring and managing security incidents, allowing for quicker identification and response to potential threats. By following the outlined steps in the RocketCyber Connection Wizard, users can activate and customize various products to suit their specific needs, ensuring that they have the right tools in place for comprehensive protection. Moreover, the ability to leverage Customer Apps not only enhances data management but also provides powerful insights through advanced filtering and reporting mechanisms. Ultimately, this integration not only fosters better collaboration between systems but also empowers organizations to stay proactive in their security measures, ensuring a robust defense against evolving cyber threats.