Discover Phase:

1. Identify and Document SOC Processes:
   • Document existing SOC processes, including ITSM or third-party tooling integration.
2. Assess Data Sources and Risks:
   • Review and inventory existing data sources, including asset management solutions.
   • Assess existing risks, threats, and data sources for input into detective controls, automation, and reporting.
3. Inventory and Review:
   • Review and document existing detective use cases, solutions, automation (SOAR), dashboards, and reports.
   • Update inventories post-review (data sources, risks, detective use cases, dashboards, automation).
4. Migration Specification:
   • Produce an overall migration specification and project plan, agreed with the customer.
5. Design SOC Processes:
   • Confirm the opportunity to design SOC processes maximising Sentinel’s features and integrating with third-party tooling.

Design Phase:

1. Security Product Design:
   • Design security products and SIEM interaction, integrating with ITSM or third-party tooling.
2. SIEM Architecture and Cost Model:
   • Develop SIEM architecture for Sentinel, including data pipeline, logging/retention, and data ingestion.
   • Create a cost model for the proposed SIEM implementation.
3. Data Model and RBAC Design:
   • Create a data model for all data sources, including entity mapping/use.
   • Design RBAC model and permissions for Sentinel and existing environment workloads.
4. Analytics and SOAR Design:
   • Design analytics against migration rules.
   • Design SOAR actions for migration via Sentinel playbook automation.
5. Workbook Factory and Testing:
   • Produce specifications and mock-up designs for migrating existing dashboards/reports into workbook format.
   • Design end-to-end test scenarios evaluating the SIEM lifecycle.

Deploy Phase:

1. Sentinel Instance Deployment:
   • Deploy Sentinel instance architecture with logging and data pipeline solutions.
2. Data Management and Migration:
   • Deploy data source collection solution from required sources.
   • Migrate historic data to logging solution and activate retention solution.
3. Rule and Solution Deployment:
   • Deploy analytics and threat hunting rules, along with supporting automation.
   • Deploy automation solutions integrating with ITSM and third-party tooling.
4. RBAC Implementation and Workbook Deployment:
   • Apply RBAC to the Sentinel instance environment.
   • Deploy workbooks and validate against data sets.
5. End-to-End Testing:
   • Complete end-to-end test scenarios to validate SIEM lifecycle.

Operate Phase:

1. Documentation and Review:
   • Document operating processes, RACI, and technical reference materials.
   • Review and sign-off delivered documentation with the customer.
2. Environment Run or Apto Managed Service:
   • Run the environment in transition to customer SIEM/SOAR operations team.
   • Start Apto managed service for operations and/or content management.
3. Monitoring and Optimisation:
   • Monitor health of data ingestion solutions and data curation pipeline.
   • Validate operating cost, analytics rules, and automation efficacy.
   • Optimise as required.
4. Validation of Integration and Workbooks:
   • Validate ITSM and third-party integration.
   • Validate workbooks against ingested data and update as required.
5. SOC Process Efficiency Validation:
   • Validate SOC process efficiency against Sentinel operation.
   • Iterate/improve processes as required.