Monitoring and Response

SOC and SIEM Console

Forward logs through BlackShield-managed agents and connectors, then investigate normalized events and raw evidence from the SOC console.

How logs flow

Customers send telemetry to BlackShield using a vendored agent, scanner client, SaaS connector, or the ingestion API. BlackShield handles the internal evidence store and search indexes. You do not configure storage buckets for normal use.

agent / connector / SaaS integration
  -> BlackShield ingestion API
  -> SOC and SIEM console
  -> detections, entity profiles, raw evidence

What analysts can do

  • Search recent events by user, IP, host, domain, process, hash, account, event type, or detection.
  • Review active detections generated from high-signal telemetry.
  • Open entity profiles to understand recent activity and risk.
  • Expand a result row to inspect the original raw event payload.
  • Build allowlisted searches visually, save them for reuse, or use validated SQL in the Advanced tab.
  • Track queued and running searches, cancel work, and review scanned-byte and execution-time telemetry.

Setup & Ingestion Wizard

The SOC console includes an end-to-end Setup & Ingestion wizard guiding operators from initial credential provisioning to live telemetry streaming, partition compaction, and threat hunting:

  • Step 1 (Credentials): Issue an API key with the ingest:siem scope.
  • Step 2 (Forwarder Configuration): Copy ready-to-run configurations for Splunk HEC, Syslog/CEF relays, Network Sensors (Suricata/Zeek/eBPF), or direct REST API streaming.
  • Step 3 (Ingestion Verification): Dispatch test batches directly from the wizard to verify lake connectivity and monitor raw object metrics in real time.
  • Step 4 (Compaction & Indexing): Optimize the lake by bundling JSON batches into columnar Parquet archives with sparse hunt keys.
  • Steps 5–7 (Hunting, Detections & Entities): Seamlessly jump into Athena SQL queries, triage active rule triggers, and inspect entity risk scores.

You can also onboard SIEM shippers through the unified Installation Wizard.

Operational defaults

SIEM searches require a time window such as last 24 hours, last 7 days, or last 30 days. This keeps investigation fast and prevents expensive historical scans unless explicitly planned with your BlackShield team. Every search runs asynchronously. BlackShield injects tenant, event-time, and projected date-partition predicates, caps rows and persisted result size, and rejects joins, subqueries, unions, mutations, and unsafe functions.

SOC and SIEM Console