Eagle SOC
The analyst portal, customer portal and orchestration platform. It stands behind this gateway.
Eagle SOCThe gateway in front of the SOC
Every customer's SIEM connects here, and nowhere else. Eagle SOC Secure is the one door between the SOC and the organisations it watches.
What it does
One door, and a lock for each customer
A SOC that watches many organisations is the place an attacker would most like to stand. So there is one way in, it is narrow, and every customer has a passage of its own.
- One way in. A WireGuard hub. Every customer's instance is a peer of its own, with keys of its own and a small network of its own.
- Customers kept apart. One customer's tunnel leads to the SOC and to nothing else. It cannot reach another customer's.
- Dialled from the customer. The tunnel is opened from the customer's side. The SOC never asks a customer to open a port to the internet.
- The portal behind a proxy. Eagle SOC is published through Caddy, with its certificate, and CrowdSec turns away addresses known for attacking.
- Seen from the portal. The state of the gateway and of every tunnel is shown in Eagle SOC, and the gateway is restarted from there when it has to be.
- Built on OPNsense. An open firewall platform with a long record, configured for this one job.
In the suite
Between the SOC and every customer
Eagle SIEM Secure
The firewall in front of each customer's SIEM, and the other end of the tunnel. It dials out to here.
Eagle SIEM Secure
Eagle SecOps Suite
One part of one system
Eagle SOC Secure is part of the Eagle SecOps Suite: governance, detection, monitoring, vulnerability scanning and secure DNS, built by one team to work as one.
See Eagle SOC Secure running
An hour with the people who built it, on a real system, with your questions. No slideware.