Orange Cyberdefense Security Event Intelligence

Security Event Intelligence is a managed SIEM solution that provides threat detection and incident response capabilities. The service aggregates, correlates, and analyzes event logs from monitored infrastructure against proprietary threat intelligence to identify suspicious activity. The solution operates through three components: a SIEM platform for event collection and correlation, a detection basis powered by threat intelligence from 500+ sources including Orange's global Internet backbone, and CyberSOC analyst support for alert qualification and incident management. The platform offers multiple deployment options including shared cloud-based, dedicated on-premises or hosted, and dedicated PDIS for operators of essential services. Organizations can also use the managed service with their existing SIEM platform. Detection capabilities include standard monitoring based on threat intelligence, targeted monitoring based on system criticality and vulnerability context, zero-day attack detection through user behavior analytics and network traffic analysis using AI and machine learning, and security orchestration and automation. Alert management services range from online alert reports through a web interface to real-time alert qualification by CyberSOC analysts operating 24/7. The service processes 27 billion correlated security events per day and manages 1,500 qualified security incidents per month across four global CyberSOCs. The threat intelligence database contains over 550 million malware signatures, 12 million entries, and draws from 600+ sources including exclusive feeds from Orange's Epidemiology Lab, next-generation sandbox, network backbone, and APT monitoring. Service delivery modes include fully managed, co-managed (hybrid), and bespoke configurations to accommodate different organizational requirements.