Cyber security threat monitoring

24/7 expert security monitoring for education and research

Our cyber security threat monitoring (CSTM) service delivers comprehensive 24/7 monitoring through advanced log consolidation and expert-driven threat analysis. We meticulously aggregate and analyse security logs from multiple sources and provide precise threat categorisation.

Our dedicated team of cyber security analysts carefully reviews each alert, dramatically reducing false positives and ensuring that your internal teams are empowered with actionable intelligence to investigate critical alerts.

Alert management and escalation

Receive timely, detailed alerts for suspicious activities, including privileged account login attempts from unusual locations, unusual authentication patterns, and potentially malicious system changes.

All CSTM customers have direct access during work hours to our CSIRT expertise for guidance and support, ensuring rapid and coordinated threat mitigation.

Detection methodology

• Notable generating rules: sophisticated algorithms trigger timely alerts when clear threats are detected, such as successful brute force attacks or known malicious activities
• Risk generating rules: advanced system builds cumulative risk scores by tracking potentially suspicious activities across your environment until they reach the investigation threshold

Both approaches work in tandem to provide layered protection that catches both obvious attacks and more subtle threat patterns.

Protection domains

• Access: continuous monitoring of login attempts, detection of impossible travel scenarios, and prevention of brute force attacks — forming a strong first line of defence against unauthorised access
• Endpoint: advanced detection of security log clearance, suspicious PowerShell command execution, system reconnaissance activities, and shadow copy tampering—identifying attackers attempting to establish persistence
• Identity: proactive security for privileged accounts by flagging potential account takeovers, unauthorised group membership changes, and suspicious MFA modifications — preventing privilege escalation before damage occurs

Integration and development

Seamlessly integrates with your existing security infrastructure, including antivirus solutions and endpoint detection services, while aggregating all relevant logs in an intuitive centralised dashboard.

Purpose-built for education and research environments in partnership with Splunk, featuring customised filters that minimise alert fatigue while maintaining security effectiveness. Continuously refined to address emerging threats and attack vectors through regular updates to detection rules and monitoring capabilities.

Service benefits

Proactive security and expert support

• Early threat detection with timely, expert-led alerts
• 24/7 monitoring of security events across your infrastructure
• Rule-based alerting
• Ability to escalate to Jisc's CSIRT for rapid incident guidance
• Advanced threat intelligence and more efficient response enablement
• Consolidated log analysis from multiple sources for deeper insights
• Advanced threat intelligence from live traffic analysis
• Severity-based alert categorisation for prioritised action
• Analyst review of all alerts to reduce false positives
• Efficient response enablement for internal teams

The Janet Network advantage

• Unique oversight of the Janet Network for enhanced threat detection
• Advanced threat intelligence from live traffic analysis
• Innovative containment options – full, partial, or scheduled blocking. For instance, partial containment ensures that essential business, security, and recovery systems remain operational, accelerating recovery significantly

Tailored for education and research

• Purpose-built for education and research
• Developed with Splunk and sector members
• Addresses sector-specific security challenges

Seamless and scalable security management

• Cloud-based SIEM solution for scalable threat monitoring
• Continuous service improvement based on user feedback
• Adaptable to emerging threats and evolving sector needs
• Works with existing security tools (antivirus, endpoint detection)
• Single dashboard for all security logs with prioritised event highlighting
• Filterable detection rules to reduce noise and improve efficiency