Rhombus use-case briefingSIEM & analytics
Search, correlate and hunt across sensor data, entirely offline
Rhombus deploys the security information and event management (SIEM) platform your analysts prefer: Elastic in Security Onion, SOF-ELK, Malcolm or Splunk Enterprise. Search and dashboards work fully offline.
Why it matters
- Alerts matter only when an analyst can search the history behind them.
- Teams work faster on the analysis platform they were trained on.
- Evidence from a sensitive network should be analyzed where it was collected.
How it works on Rhombus
- Security Onion keeps its Zeek and Suricata data in Elasticsearch, searchable in Kibana.
- A clustered Elastic stack, SOF-ELK or Malcolm deploy from the console catalog, chosen to match the team's workflow.
- With the clustered Elastic stack, MixMode data gets prebuilt triage and hunting dashboards.
- The clustered Elastic stack, SOF-ELK and Malcolm run on images hardened to the DISA STIG (Security Technical Implementation Guide) in FIPS mode, scanned after each build.
- Splunk Enterprise can also run on the kit, licensed separately and configured before delivery by our Splunk Core Certified Consultants.
From deployment to results
- Deploy the sensors and your chosen analytics platform; Splunk Enterprise arrives configured.
- Run kit validation and review each platform's STIG scan.
- Open the triage dashboards and hunt from alert to session.
- Upload packet capture (PCAP) files to Malcolm for session-level review.
Defense and government use cases
- Defensive cyber operations (DCO) teams correlating network alerts during a mission.
- Incident response and hunt-forward teams reviewing captured PCAP on site.
- Analyst training on the same platforms used in the field.
Commercial use cases
- Enterprise incident response teams that need an isolated analysis environment for a breach.
- Banks and financial services keeping investigation data inside a controlled enclave.
- Managed security service providers (MSSPs) standing up per-engagement analytics.
Outcomes
- Network alerts, protocol logs and anomalies share one searchable history.
- MixMode data in one Kibana, on kits with the clustered Elastic stack.
- The clustered Elastic stack, SOF-ELK and Malcolm each get a STIG scan score after every build.
Considerations
- Security Onion covers most kits; a clustered Elastic stack adds scale for larger retention or data volume.
- Elastic runs free or paid. We recommend paid for single sign-on, advanced alerting and AI features on the kit's GPU and local models.
- Malcolm reviews uploaded packet captures; live capture can be enabled when the mission needs it.
Integrated tools
- Elastic
- SOF-ELK
- Malcolm
- Splunk Enterprisecommercial
Commercial products are licensed as part of your configuration. Product names are trademarks of their respective owners, and their use does not imply endorsement.