MTI Technology Ltd

MTI SOC and SIEM Managed Service

MTI Managed SIEM (Security Information and Event Management) provides a centralised security monitoring, threat intelligence and response service for on-premises, hybrid and cloud environments. Our UK based Security Operations Centre, with SC Cleared analysts, is fully integrated with Alien Vault's market leading technology and offers 24*7*365 assurance to your business.

Features

• 24x7 Monitoring through a UK based Security Operations Centre (SOC)
• Aggregate and examine all your organisation’s log data
• Proactive Threat Intelligence, analytics and response
• Endpoint monitoring and protection
• Cloud and on-premise User Behaviour Analytics (UBA)
• Vulnerability and Patch Scanning
• Automated Incident Response Actions
• Proactive 24x7 notification of threats, attacks or breach activities
• Full Managed Service with Incident Response
• Full install and configuration service available

Benefits

• Reduce risk of successful cyber attacks
• Improved compliance regime, supports NCSC CAF and ISO27001
• Complete asset inventory and asset register
• Endpoint analysis and protection
• Customisable dashboards and reporting
• Regular vulnerability scanning of all assets
• Full integration with ServiceNow, JIRA and other ticketing solutions
• Pre-Built with Circa 2,000 Threat Correlation Rules and Alarms
• Full user behaviour analysis across the entire network and cloud
• World-leading Threat Intelligence updates every day

£4,600 a unit a month

• Education pricing available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bid@mti.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

761283942448544

Contact

Darren Moyes
01483520200
bid@mti.com

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: Firewalls, Switches, Routers, Servers, Endpoints, Databases, Webservers, Logs, Windows Servers, Cloud Environment (Azure, AWS, Gcloud), printers, web applications, PAM, IAM, Active Directory.
• Cloud deployment model: Hybrid cloud
• Service constraints: No
• System requirements:
  • Logs to feed into the service
  • Logging enabled on all devices that form the SIEM scope

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Support is provided 24/7/365; P1 Response time is 30 minutes 24x7x365
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Web chat
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.1 AA or EN 301 549
• Web chat accessibility testing: Testing done by Microsoft in alignment with WCAG standard
• Onsite support: Yes, at extra cost
• Support levels: Full 24x7x365 Managed Service with full incident management. We also provide "out of hours / weekends" to support customers with existing in-house, working hours SOCs. We include the following nominated support staff in our Managed SIEM service: - Transition Manager - Duty Manager - Service Delivery Manager - SecOpps Technical Lead Engineer - Client Director
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Software installation by customer or MTI consultancy services
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Configuration files can be exported & data deleted
• End-of-contract process: License expieres and service stops

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: Yes
• Compatible operating systems:
  • Linux or Unix
  • MacOS
  • Windows
  • Other
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The AT&T AlienVault USM Anywhere (USMA) web dashboard is a security management platform that provides a centralized view of an organization's security posture. It allows IT security teams to monitor threats, incidents, and vulnerabilities across their network, endpoints, and cloud environments. The dashboard offers real-time threat intelligence, intrusion detection, and incident response capabilities. In simpler terms, it's a security control center that helps businesses see and manage their IT security risks. The SIEM dashboards are fully customisable using built-in widgets. Different user roles and rights can be configured to different dashboards to fit any internal needs and privilege restrictions.
• Accessibility standards: None or don’t know
• Description of accessibility: Users can access customisable dashboards and reports
• Accessibility testing: In-built browser assistance
• API: Yes
• What users can and can't do using the API: USM Anywhere offers a RESTful API for programmatic access. To use it, create an API client within the web interface and obtain a Client ID/Secret for authentication.; ; The API focuses on security events and alarms. You can use it to retrieve incidents, threat details, and generate reports (limited compared to web UI). However, creating users, managing permissions, or configuring core functionalities cannot be done through the API.; ; Limitations include focus on alarms/events, restricted user/configuration management, and potential throttling of excessive requests.; ; For details, refer to the official API documentation: https://cybersecurity.att.com/documentation/api/usm-anywhere-apis.htm?Highlight=api
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: What is monitored, reporting levels and alerting thresholds, custom reports, custom searches and tailored response actions and playbooks.

Scaling

• Independence of resources: Vendor defined service capacity for the platform. As regards SOC staffing, ; through continual capacity monitoring and management, MTI ensure that the ratio of Staff per customer ensures they have sufficient time, skills and resilience to service all customers on a run and burst basis. Tracking resource consumption, we forward plan team hires in advance ensuring there is always sufficient skilled and experienced analysts available to deliver the service to agreed SLA's and KPI's.

Analytics

• Service usage metrics: Yes
• Metrics types: MTI produce a Monthly IT Service Management report, that includes all of the key metrics value and development of the service which can be tailored to the Customers’ requirements: o Tickets Raised and Resolved Summary o Successes o Customer Experience - Performance against agreed Incident and Service Request KPI’s o Alarm & Incident Stats and Summary / Charts o Listing of All Incidents Raised and Status o Service Status o Problem Records o Change and Service Request Summary
• Reporting types:
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: AT&T AlienVault (USM Anywhere)

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Via the console. A request is submitted for the desired date range. Shortly after a link is provided to download the data to a repository of the customer's choosing.
• Data export formats: Other
• Other data export formats: User defined
• Data import formats: Other
• Other data import formats: User defined

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: 99.95% Up time
• Approach to resilience: Multiple Instances, hardware and datacentres
• Outage reporting: Email Alerts - In the event a Service Outage occurs, alerts will be reported via email alerts, with hourly updates until the service is resumed. Details of any outages are recorded in the Monthly ITSM report for tracking and monitoring.; Public Dashboard - https://status.alienvault.cloud/

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Username or password
• Access restrictions in management interfaces and support channels: Access granted to specific users based on Role-Based Access Control (RBAC): user permissions are allocated to specific roles based on principle of least privilege (PoLP).
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: 29/09/2006
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2007 certification: No
• CSA STAR certification: Yes
• CSA STAR accreditation date: 22/05/2015
• CSA STAR certification level: Level 3: CSA STAR Certification
• What the CSA STAR doesn’t cover: None
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications: ISO/IEC 27018 AICPA SOC (SAS 70 Reports), Cloud Security Alliance

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ISO/IEC 27001

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: Supplier-defined controls
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: Supplier-defined controls
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Supplier-defined controls
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Supplier-defined controls

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  Fighting climate change; ; MTI publishes an annual Quality & Environmental (Q&E) Policy statement, which is aligned to its ISO 9001 & ISO 14001 accreditations and the annual EcoVadis CSR review and accreditation. MTI’s Corporate & Social Responsibility policies integrate our business values and operations to meet our strategic objectives and the expectations of our customers, employees, investors, suppliers, the community and the environment. By putting our CSR into practice, we are committed to conducting ourselves responsibly and in an ethical manner, creating a positive and supportive working environment, supporting local communities, improving service levels to customers, acting fairly and collaboratively with suppliers and other third parties, to deliver solutions that support our environmental objectives. Our Environmental Management System, recognised by independent ISO 14001 Environmental Management certification, incorporates our Environmental Policies and Procedures.Demonstrating our commitment to protecting the environment and sustainability. We undergo regular independent audits to demonstrate our commitment to improvement. Our management review programme and CSR and Environmental Reporting, evaluate and demonstrate our environmental achievements, through measurement of impacts as a result of all business activities, monitoring of reduction targets, achievements against objectives & results from our activities, initiatives and environmental commitments. Our FY2022 focus includes; Zero-Carbon Society: we will strive to achieve zero emissions from our own business activities and encourage carbon neutrality within our supply chain. Through comprehensive energy conservation activities and the use of renewable energy, we aim to reducing our carbon footprint and impact on the environment through reduction of contributions to greenhouse gases (GHGs) and annual CO2 emissions, and support supplier commitments; •Partnering with Tier-1 suppliers who are committed to carbon neutrality, evidenced through annual environmental and sustainability assessment •Commitment form partners/product vendors to commit to supplying packaging with a minimum of 50% recycled content (80% Cardboard) or be entirely derived from sustainable sources.

  Covid-19 recovery

  Covid-19 recovery; ; In response to the COVID-19 pandemic, MTI has implemented thorough in-house technology solutions allowing over 90% of our staff to be based at home, including the majority of our service delivery staff. This approach provides greater job opportunities across the region without the potential for geographically disadvantage, and ensures we have skilled staff locally across the UK to deliver our core services. Where MTI are delivering longer-term services to Buyers, MTI is committed to sourcing and utilising local suppliers to provide relevant elements of the service and would support running local supplier days to publicise the delivery and give opportunities for local company involvement. MTI recognises that the COVID-19 pandemic presents challenges for graduate employment and is offering employment opportunities for graduates in order to support local students to progress from higher education into jobs utilising their skills and knowledge.

  Tackling economic inequality

  Tackling economic inequality; ; MTI has invested significantly in developing in house skills and capabilities in order to provide high-class services across a wide range of technologies and disciplines, with emphasis on providing a wide range of professional and managed services. Our Internal Development Programmes and individual development plans ensure that all employees are offered opportunities for learning and development and provides skills training for new employees and existing employees to prepare them for promotions, transfers or new responsibilities. Our development programmes help our employees stretch their capabilities and those of the organisation, upskilling employees through investments in a wide range of skills and product training and development for staff and managers to broaden opportunities. Building a diverse and inclusive workplace has become an imperative part for the all-round growth and development of MTI. Therefore, our HR team takes tangible steps to create a workplace that is committed to diversity and inclusion, including providing career opportunities to support disadvantaged people into the workplace. MTI are registered to the Disability Confident scheme, and have agreed to the Disability Confident commitments to provide interventions to increase employment opportunities and retention for people with a long- term health condition or disability to support these people into employment.

  Equal opportunity

  Equal opportunity; ; We recognise our obligations under the Equality Act 2010, Article 119 of the Treaty of Rome, The Race Relations Act, The Employment Equality (Sexual Orientation) Regulations 2003 and The Employment Equality (Religion or Beliefs) Regulations 2003, and The Codes of Practice published by the Equal Opportunities Commission, the Commission for Racial Equality and the European Commission; We are committed to the principle of equal opportunities in employment. We are opposed to any form of less favourable treatment or financial reward through direct or indirect discrimination, harassment, victimisation to our staff members or job applicants on the grounds of race, religious beliefs, political opinions, creed, colour, ethnic origin, nationality, marital/parental status, sex, sexual orientation, offending past, disability, age, caring responsibilities or social class. We extend protection under this Policy to our suppliers, customers, contractors, and others who are on our premises and in return expect all suppliers, customers, contractors and others to behave in the same way towards our members of staff. This policy is intended to assist the organisation to put this commitment into practice. Compliance with this policy should also ensure that employees do not commit unlawful acts of discrimination. Communicating this policy will be supported by appropriate training, and the effectiveness of this Policy will be monitored on an on-going basis. No form of intimidation, bullying or harassment will be tolerated. Implementation of this policy will be carried out where necessary by invoking the Disciplinary Procedure. Every employee is required to assist the organisation to meet its commitment to provide equal opportunities in employment and avoid unlawful discrimination.

  Wellbeing

  Wellbeing; ; The organisation has developed an employee wellbeing policy to manage its obligations to maintain the mental health and wellbeing of all staff. It covers the organisation's commitment to employee health, the responsibilities of managers and others for maintaining psychological health, health promotion initiatives, communicating and training on health issues, the range of support available for the maintenance of mental health, and organisational commitment to handling individual issues.

Pricing

• Price: £4,600 a unit a month
• Discount for educational organisations: Yes
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bid@mti.com. Tell them what format you need. It will help if you say what assistive technology you use.