CIS observability with Elastic
Read how Minoan Security helped a Swiss enterprise build CIS compliance observability from scratch, with Elastic
The Problem
- Customer had no CIS observability across on-premise virtualized servers and applications
- Lacked in-house Elastic expertise to build or operate a CIS observability solution
- Needed to test Elastic as a potential candidate for future migration as an MVP
The Solution
- Deployed Elastic Agents to collect the logs across the client infrastructure
- Architected and implemented appropriate Elastic infrastructure (e.g ingestion pipelines, index templates, ILM policies, transforms) to ETL their raw data to structured logs
- Built detection rules to page via email for non-compliant servers and applications
- Built dashboards to track server specific and overall CIS compliance across platforms over time
The Impact
- Improved CIS compliance across the enterprise, including trends over time for all scoped servers and applications
- Standardized process for onboarding new sources into the CIS observability system
- Gained visibility and alerting over non-compliant CIS controls and resources
- Knowledge transfer enabled internal team to operate the delivered MVP autonomously
