Log360 SIEM For The NHS and Regulated Sector

Getting the logs into one place was the hard problem a decade ago. It isn't the hard problem now.

The hard problem now is that the handful of events that matter sit inside a volume that doesn't, and the cost of missing them is measured in the time an attacker spends inside the estate before anybody notices.

This is what ManageEngine Log360 does about that, written for the person who has to run it rather than the person who signs for it. Everything here traces back to ManageEngine's own documentation, linked as we go, so you can check any of it at source.

McCormickCo Security is the UK's first ManageEngine Gold Partner and delivers Log360 end to end for the NHS and the wider regulated sector.

You're Not Short Of Data. You're Short Of Signal.

A SIEM doesn't exist to hold logs. It exists to reduce them to a set of things a person should look at.

Log360 groups related detections into a single incident rather than passing every one through to the console, and uses behavioural baselines as a filter before an alert is raised at all. SOAR then separates the high-volume, low-severity alerts from genuine incidents and enriches what's left with threat context.

For a team of two or three, which is where most trusts sit, that difference decides whether the platform gets used or quietly ignored. An analyst who's learned that most alerts are noise will eventually treat all of them as noise, and that's exactly the failure a SIEM is meant to prevent.

The detection library behind it runs to more than 2,000 prebuilt detections, every one mapped to MITRE ATT&CK and maintained by an in-house threat research team. They work three ways rather than one, which matters because each catches a different class of problem. Correlation rules look for sequences of events across sources. Anomaly rules look for departures from a baseline. Threat intelligence matches observed indicators against known bad ones. An attack that evades one is often visible to another.

Detections arrive from the cloud, which matters more than it sounds. A rule set that ships with the product and then sits still ages badly, and static detection stops catching things without announcing that it has. Cloud delivery means the library improves without a platform upgrade being scheduled, which in an NHS change process is the difference between quarterly and never. Rules are built through an interactive interface, so tuning doesn't depend on the one person who can write query language. In a small team, a capability only one person can operate isn't really a capability.

The hardest attacks to spot, though, are the ones using legitimate credentials. When the login is real, signature-based detection has nothing to fire on, because nothing about the authentication is wrong. Log360's user and entity behaviour analytics builds a baseline of normal behaviour for every user and device, then flags what departs from it: a logon at an unusual hour, a spike in access, a data transfer that doesn't fit the pattern. Each entity carries a risk score, which is what turns a flat list of anomalies into an ordered one.

In a clinical setting that matters more than it does elsewhere. Shared accounts, rotating staff and legitimate out-of-hours access make static rules almost useless: three in the morning is normal for one department and alarming for another. A per-entity baseline handles that without anyone having to write it down.

None of which helps if the volume reaching the console is still unmanageable. The easy way to reduce alert volume is to turn alerts off, and it's also how the real one gets missed. Log360 takes the harder route. Adaptive thresholds learn your environment's normal patterns continuously rather than at a point in time. Object-level filters focus detection on high-value users, groups and organisational units while suppressing noise from test and developer accounts. Tuning insights identify your noisiest rules and recommend specific fixes rather than leaving you to work out where the volume is coming from.

One emergency services customer reported a 90% reduction in false and low-priority alerts using these techniques. The number will differ in your estate. The point is that the reduction came from tuning rather than from turning detection off. Tuning is also the work most often skipped after go-live, because the deployment project closes and nobody owns it. We'd build a quarterly review into the operating model from the start, on the basis that an untuned SIEM degrades quietly rather than failing visibly.

Detection Is Only Half The Job

Detection is where most SIEM conversations stop. Working out what actually happened, and then containing it, is where the team's time goes.

The Incident Workbench is a dedicated investigation console, opened from any of the SIEM dashboards. It brings behavioural analytics, process trees showing parent and child spawning, and threat analysis of addresses, URLs, domains and files into one place, with VirusTotal enrichment alongside. Entity-based attribution identifies who or what was involved with the full activity trail attached. Interactive timelines show the sequence from initial access through to impact.

An analyst can open up to twenty analytical tabs in a single instance and save them to the incident as evidence. That last point is worth dwelling on if you've ever had to write an incident report from memory a fortnight later. The evidence trail is captured as the investigation happens rather than reconstructed afterwards, which is the difference between a report that stands up at audit and one that doesn't.

Zia Insights, Log360's contextual AI, sits in the same console. It takes a single alert and produces a readable summary of what happened, maps the activity to MITRE ATT&CK, reconstructs the timeline and suggests what to do next. It's built with bring-your-own-key support, so it works with the AI provider you choose rather than committing you to one.

For NHS organisations that isn't a convenience feature. Where AI processing happens, under whose terms, and whether patient-adjacent data could end up in a prompt are questions your information governance team will ask early. Being able to answer them with a named provider under your own agreement is a great deal easier than not being able to. We'd raise it at design stage rather than at the DPIA.

Containment is the other half, and containment that depends on manual coordination between the security team, IT and the cloud team creates exactly the delay an attacker is built to exploit. Log360's integrated SOAR ships with more than forty playbook templates, so the common actions don't have to be built from nothing. From one incident view a playbook can disable an account, isolate an endpoint, update a firewall policy and raise an ITSM ticket, without leaving the console.

Two cautions from experience. Automated containment needs a documented authorisation position before you enable it, because isolating an endpoint that turns out to be a clinical device is a patient safety event, not just an operational one. And the measure worth tracking isn't how many playbooks exist. It's how many of your actual containment steps still need somebody to open a second tool.

One View Across a Hybrid Estate

An attack that starts in identity, moves to an endpoint and reaches a cloud workload is one connected story in Log360. Split across three tools it's three disconnected alerts, and nobody joins them up until afterwards.

The integrated cloud access security broker extends that to shadow IT and cloud policy violations, which in most NHS estates is a larger surface than anyone expects once departments and clinical services have procured their own services directly. Data loss prevention sits in the same platform, so movement of sensitive data is assessed against the same behavioural context rather than in a separate console with its own queue.

The same principle applies to what arrives from outside. Log360 aggregates intelligence from Webroot, STIX and TAXII feeds, VirusTotal, AlienVault OTX and Constella Intelligence, normalising indicators and matching them against observed events so detections arrive already enriched.

Dark web monitoring, through the Constella partnership, hunts the deep and dark web for your organisation's leaked credentials and exposed data, and alerts in real time when something appears. What makes it more than an alerting service is correlation: findings can be matched against internal activity to establish whether exposed credentials were actually used. That's the question that matters once a leak is confirmed, and it's the one otherwise answered by guesswork.

One point easy to miss in a demonstration. Dark web monitoring runs on the Advanced Threat Analytics add-on licence. It isn't part of the base entitlement. Budget for it deliberately, and confirm the position for your edition before it reaches a business case. We'd rather say that now than have it surface at contract stage.

Audit Ready, Not Audit Panicked

Compliance reporting should be a by-product of good security rather than a separate exercise that starts when the auditor writes.

Log360 ships with a large library of preconfigured report templates and preserves the integrity of the underlying log data for evidential use. When proof is requested the report already exists, and the chain of evidence behind it is verifiable rather than asserted.

For DSPT submissions that turns audit season from a scramble into an export. The value isn't the reports themselves: it's that the reporting and the operating platform are the same system, so evidence can't drift away from reality between assessments. What we add is the mapping, because a report is only useful at audit if somebody can say which outcome it evidences.

See It On Your Own Data

The honest test of a SIEM isn't a slide deck. It's your own telemetry, your own noise profile and your own estate, because the interesting findings are always the ones nobody expected.

We can show you Log360 working on real data: a live demonstration, or a proof of concept in your own environment. As the UK's first ManageEngine Gold Partner, we handle selection, sizing, deployment, tuning and ongoing operation, with the compliance mapping regulated organisations need alongside it. Where Log360 is already deployed, we also run a free health check against your live console under read-only access, with every finding mapped to the DSPT CAF outcomes it affects.

If you'd like to see what Log360 could do for your security team, we'd welcome the conversation.

Contact | McCormickCo Security. Our team can talk through architecture, sizing, licensing and DSPT evidence mapping, and help you assess how this fits your environment.

‍