Skip to content
Made in the UK

How do MSPs run SIEM and log management for clients?

By , CTO, CybaVerse. Last reviewed

MSPs run SIEM and log management by collecting the security logs that reveal attacks, normalising them to a common schema, applying maintained detection rules and retaining data for as long as investigations and obligations require. The hard part is staffing: a SIEM needs analysts watching around the clock, which is why many MSPs pair it with MDR.

This guide is part of the CybaVerse Knowledge Hub.

What is a SIEM for, in an MSP context?

A SIEM collects security events from many sources, stores them, and runs detection rules that turn events into alerts. For an MSP, it is the place where identity, endpoint, email and network activity for each client can be searched together, so an attack that moves between systems can be followed end to end.

The NCSC introduction to logging explains that logs are only useful if they are collected deliberately, protected and actually reviewed. NIST SP 800-92 makes the same point about log management planning. Collecting everything and reviewing nothing gives clients a false sense of security.

Which logs should MSPs collect first?

Collect the sources that show how most attacks start and spread. For most MSP clients that means identity and sign-in logs, endpoint telemetry, email activity and firewall logs. Add cloud and server logs once those are flowing reliably and the volume, cost and retention are understood for each client.

SourceWhat it reveals
Identity and sign-in logsStolen accounts, unusual locations, MFA abuse
Endpoint telemetryMalware, suspicious processes, persistence
Email activityPhishing, forwarding rules, mailbox abuse
Firewall logsCommand and control, data leaving the network

How do you run a SIEM well across many clients?

Running a SIEM across many clients needs the same discipline for every tenant: consistent sources, consistent rules and someone accountable for each alert. The steps below suit most MSPs and reflect public guidance from the NCSC and NIST on security logging and monitoring.

  1. Step 1: Agree sources per client

    Start with identity, endpoint, email and firewall.

  2. Step 2: Normalise the data

    Map fields to a common schema such as OCSF so searches work across sources.

  3. Step 3: Use maintained detection rules

    Sigma rules give a shared, readable format for detections.

  4. Step 4: Watch data health

    Alert when a source stops sending data, so blind spots are fixed quickly.

  5. Step 5: Set retention per client

    Balance investigation needs, legal obligations and cost.

  6. Step 6: Staff the response

    Make sure alerts are triaged and acted on at any hour.

Which questions does this cluster answer?

The pages below answer the SIEM and log management questions MSPs ask most, from OCSF to retention periods. Each page gives a direct answer and practical steps. Use the links to go straight to the question you need.

  • How do MSPs run a SIEM without a 24/7 SOC?
  • What is OCSF and why does it matter for MSP log normalisation?
  • How do Sigma rules work in an MDR platform?
  • SIEM vs MDR for MSPs: which do clients need?
  • How long should MSPs retain security logs in the UK?
  • How does MDR case management work from alert to closure?

How does CybaOps handle SIEM for MSPs?

CybaOps brings log collection, normalisation and investigation into the same platform as MDR, with the CybaVerse SOC watching around the clock. MSPs get searchable, normalised data for every client without running a separate SIEM and a separate queue, and SIEM is included in the CybaOne package.

  • CybaOps collects security logs from endpoints, firewalls, cloud and Microsoft 365 into one place.
  • CybaOps normalises security data to the open OCSF schema.
  • Analysts and partners can search and investigate across their data in CybaOps, with AI help to build queries.
  • We are building a correlation engine into CybaOps that links related alerts into a single incident.
  • CybaOps offers configurable retention.
  • CybaOne adds SIEM, an external penetration test and dark web monitoring to everything in CybaEdge.

SIEM and logs

How MSPs run SIEM and log management

MSPs run SIEM and log management by collecting the security logs that reveal attacks, normalising them to a common schema, applying maintained detection rules and retaining data for as long as investigations and obligations require.

01 Log sources

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

SIEM and logs

02 The 6-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • SIEM in
  • CybaOne

What else do MSPs ask about SIEM?

These are the follow-up questions we hear most from MSPs weighing SIEM and MDR for their clients.

Do clients need both a SIEM and MDR?

Many need the outcome of both: logs that can be searched, and people who act on them. Platforms that combine SIEM and MDR avoid running two tools and two queues for each client.

How long should logs be kept?

It depends on investigation needs, contracts and legal obligations. Keep enough history to investigate an attack that started weeks before it was noticed, and record the retention decision for each client.

What is OCSF?

The Open Cybersecurity Schema Framework is an open standard for describing security events. Normalising to it lets one search cover data from many different tools.

What should you do next?

See how the pieces fit together on the CybaOps platform page. MSPs can read about the CybaVerse partner model for MSPs.

See search, investigation and case management in CybaOps.

Book a CybaOps demo