Internal Network Security • Penetration Testing • ISO Readiness
An AI-driven voice agent provider delivering automated customer care solutions required improved security visibility across its cloud based environment. The platform operates on Azure virtual machines and integrates firewalls, identity management, and endpoint services to support large scale, real time interactions.
As the AI voice agent platform scaled, security data was spread across cloud infrastructure, firewalls, identity systems, and endpoints. The lack of a centralized monitoring solution limited visibility into security events, authentication activity, and potential threats, creating operational blind spots and slowing incident response.
As the platform scaled, the client needed a centralized SIEM solution to unify security monitoring across cloud, firewall, endpoint, and application layers. They engaged us to implement Wazuh for centralized log correlation, threat detection, vulnerability management, and real-time alerting to strengthen security posture and operational readiness.
The client requested a centralized SIEM solution using Wazuh to unify security monitoring across their environment, with integration of firewall, endpoint, and application logs. They also required real time alerting, vulnerability detection, role based access, and dashboards to improve security visibility and operational readiness.
Engaged with engineering and security teams to analyze architecture, operational workflows, and risk surface.
Defined SIEM deployment strategy, log sources, security controls, dashboards, and SOC workflows.
Installed and configured Wazuh Manager and agents across cloud workloads and internal endpoints.
Created access roles for relevant teams based on least-privilege and operational responsibilities.
Integrated: Azure VM logs, pfSense / Suricata Firewall logs, Keycloak authentication logs via secure API
Agent activity monitoring, Vulnerability management (CVE scanning), Threat intelligence enrichment using Wazuh CTI & MISP external threat feed
Implemented dashboards visualizing: Global geo map of requests & access locations, Successful vs failed authentications, SSH access monitoring, Threat summaries and attack attempts
Configured alerts for: Authentication anomalies, Brute-force or malicious activity, Firewall-based threat events, Email-based incident notifications.
Delivered: Complete project documentation, SIEM architecture diagrams, Vulnerability and patch management guidelines, Daily SOC operation playbook