SIEM: why every business needs one, and how it helps with NIS2

Almost every cyberattack leaves traces: failed logins, an unknown process on a server, a new administrator account, unusual traffic through the firewall. The problem is that these traces are scattered across hundreds of logs on dozens of devices, and nobody is looking at them. That is why many companies only find out about an attack when their systems stop or their data leaks.

This is exactly where a SIEM helps.

What a SIEM is

A SIEM (Security Information and Event Management) system collects the events from all your devices in one place: servers, computers, firewalls, email and cloud services. It analyses them automatically, connects separate signals into one picture, and alerts you when something looks like an attack.

In other words, a SIEM is CCTV for your IT infrastructure, with a guard who never falls asleep.

Why every business needs one

• Visibility. You see what is happening across all your systems from one place, not device by device.
• Early detection. Suspicious logins, password-guessing attacks and malware are spotted in minutes, not weeks.
• Fast investigation. When something happens, you know who did what, when and from where.
• Reliable evidence. Logs are stored centrally and protected, so an attacker cannot cover their tracks by deleting them from a compromised computer.
• Less damage. The earlier you detect an attack, the less it costs: shorter downtime, less leaked data, easier recovery.

Why a SIEM is key for NIS2

The Cybersecurity Act that brought NIS2 into Bulgarian law does not literally require a “SIEM system”. But without central monitoring of events, several obligations are close to impossible in practice:

• The 24-hour deadline. After a significant incident you must send an early warning within 24 hours, a notification within 72 hours and a final report within one month. You cannot report an incident you have not noticed, and the final report needs an accurate timeline of events.
• Detecting and handling incidents. The risk-management measures include detecting and handling incidents. A SIEM is the tool that detects them.
• Explicit logging requirements. For digital providers such as cloud services, data centres and managed IT services, Implementing Regulation (EU) 2024/2690 explicitly requires log collection, regular review, automatic alerts and a defined retention period. For other companies, it is a good guide to what inspectors will expect.
• Evidence for the regulator. Reports and logs show that your security measures actually work, not only on paper. This matters for management too, who are personally accountable under NIS2.

Why we recommend Wazuh

Commercial SIEM systems often cost tens of thousands of euros a year and are priced per device or by data volume. That is why, for most companies in Bulgaria, we recommend Wazuh, an open-source SIEM and XDR platform used by organisations around the world.

• No licence fees. Wazuh is free and open source. You pay only for the server and for the work to deploy and run it, not for every computer or gigabyte of logs.
• All logs in one place. A lightweight agent for Windows, Linux and macOS, plus log collection from firewalls, network devices and cloud services such as Microsoft 365, AWS and Azure.
• Threat detection. Ready-made rules mapped to the MITRE ATT&CK framework detect suspicious logins, privilege escalation and malware.
• Vulnerability detection. Shows which software has known vulnerabilities (CVEs) and which systems to update first.
• File and configuration monitoring. You know when and what changed in critical files, and whether servers follow security best practice (CIS Benchmarks).
• Automatic response. It can block an IP address or stop a process on its own when it detects an attack.
• Compliance reports. Ready-made dashboards for PCI DSS, GDPR, NIST 800-53 and other standards make audits easier.

Important: the tool alone is not enough

A SIEM is only valuable if it is configured properly and someone actually watches the alerts. An untuned system produces thousands of warnings that nobody reads. NIS2 also requires policies, risk analysis, continuity plans and training. Wazuh covers the technical monitoring, not everything else.

How we help

1. Assessment. We review your infrastructure and decide which systems need to be monitored.
2. Deployment. We install Wazuh in your environment or in our private cloud, and connect servers, computers, firewalls and Microsoft 365.
3. Tuning. We tune the rules so the alerts are few and meaningful.
4. Training and support. We show your team how to work with the dashboards and alerts, and we are there when you have a question or suspect an incident.

Velox is certified to ISO 27001, the information security standard that NIS2 builds on.

Wazuh is a trademark of Wazuh, Inc. Velox is not affiliated with Wazuh, Inc. This article is a summary, not legal advice.