A small company based in Spain, Europe, operating in the internet betting industry, faced specific business challenges. With a data lake for information storage, the company sought integrated utilization with EDR. Additionally, they had a prior experience with an ineffective SOC and lacked knowledge about visibility.

As part of the solutions and approaches provided to the client, the implementation of a monitoring system for their data lake was initiated to gather information on emerging vulnerabilities. This involved monitoring and integrating sources in the data lake for use cases and CVE trending surveillance within an autonomous platform. Support was provided for the integration of sources into their detection engine.

Following this approach and these solutions, immediate visibility into the origin sources integrated in Elastic and the EDR was successfully achieved. Additionally, processing rules for network inspection were incorporated to complement alert information. Another noteworthy outcome was the monitoring and notification of trending vulnerabilities by potential actors affecting the customer from the first day of service. Additional benefits included model adaptation through CSM 8x5, investigations on critical business processes conducted by a team of experts, and the visibility of previously undetected behaviors (50 UC were activated in the platform).