Connector Subsea Solutions centralises log visibility across its network and Microsoft 365 with Log360 Cloud

Business challenges

• Limited visibility of device logs: The IT team had little insight into what its infrastructure devices were logging—management devices in particular—leaving gaps in its understanding of what was happening across the estate.
• Threats spread across multiple systems: With logs scattered across switches, access points, servers, storage, and cloud services, it was difficult to detect activity that only became suspicious when viewed across more than one system.
• A hard-to-deploy alternative: Wazuh, the open-source SIEM the team had been testing, proved difficult to configure across all devices and lacked agents for straightforward deployment, so it never became a workable solution.

The problem

Connector Subsea Solutions' IT team looks after a mixed environment spanning multiple offices: Aruba switches, Ubiquiti UniFi access points, Windows domain controllers and Active Directory, Synology NAS storage, and a Microsoft 365 tenant with Microsoft Entra ID. Before implementing a SIEM, logs from these systems sat in their own silos.

The most common challenges were limited visibility of device logs, especially from management devices; gaps in compliance and audit coverage; and the difficulty of detecting threats whose signs were spread across multiple systems rather than contained in one. Investigating an issue meant checking each source separately, which slowed both detection and response.

The team had been evaluating other options before settling on Log360 Cloud. Wazuh, the open-source SIEM it tested, was hard to configure on all of its devices and offered no agents to simplify deployment, which made it impractical for a small team to roll out and maintain.

The solution

Connector Subsea Solutions deployed ManageEngine Log360 Cloud, choosing it over the alternative it had been testing because it was straightforward to implement and its agents made deployment across the estate simple. The team now collects logs from its Aruba switches, domain controllers, UniFi access points, Active Directory, and Synology NAS into a single cloud-hosted platform, which has proven to be a reliable source of logs across the environment. Because the platform runs in the cloud, the team can access it from anywhere.

Bringing every log source into one place has transformed how the team investigates issues. Events from different devices can be read side by side in a clear, understandable format, and having all the context together has sharply reduced the mean time to respond to an incident.

On the security side, the team has integrated Microsoft 365 and Microsoft Entra ID with Log360 Cloud to surface unusual identity activity, such as users being added to groups and changes to Conditional Access policies. This integration has also given the team visibility of when external users are invited into its Microsoft 365 tenant, an event that would previously have gone unnoticed.

The platform's value has extended beyond security. In one instance, the team used Log360 Cloud to track down the cause of a slow internet connection at a remote office: a single employee was uploading large files to OneDrive, consuming bandwidth for everyone else on site.

Support has been fast and clear, and the team is now evaluating an upgrade to add automated playbooks and take its incident response further.

By centralising logs and alerts from its network devices, servers, storage, and Microsoft 365 into one cloud platform, Connector Subsea Solutions can detect and resolve issues and incidents far faster than before. The team rates its overall experience with Log360 Cloud at 10 out of 10 and is highly likely to recommend it.

About Log360

Log360 is a unified SIEM solution with integrated DLP and CASB capabilities that detects, prioritizes, investigates, and responds to security threats. Vigil IQ, the solution's TDIR module, combines threat intelligence, an analytical Incident Workbench, ML-based anomaly detection, and rule-based attack detection techniques to detect sophisticated attacks, and it offers an incident management console for effectively remediating detected threats. Log360 provides holistic security visibility across on-premises, cloud, and hybrid networks with its intuitive and advanced security analytics and monitoring capabilities. For more information about Log360, visit manageengine.com/log-management/ and follow the LinkedIn page for regular updates.