{"id":130,"date":"2026-09-13T20:56:44","date_gmt":"2026-09-13T20:56:44","guid":{"rendered":"https:\/\/neranis.com\/?post_type=nrn_service&#038;p=130"},"modified":"2026-09-13T20:56:44","modified_gmt":"2026-09-13T20:56:44","slug":"collecte-de-journaux-et-deploiement-du-siem","status":"publish","type":"nrn_service","link":"https:\/\/neranis.com\/fr\/services\/log-collection-and-siem-deployment\/","title":{"rendered":"Collecte des journaux et d\u00e9ploiement du SIEM"},"content":{"rendered":"<section class=\"wp-block-group nrn2-section nrn2-page-hero is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-breadcrumb wp-block-paragraph\"><a href=\"https:\/\/neranis.com\/fr\/\">Accueil<\/a> <span aria-hidden=\"true\">\/<\/span> <a href=\"https:\/\/neranis.com\/fr\/expertise\/\">Expertise<\/a> \/ <a href=\"https:\/\/neranis.com\/fr\/expertise\/operations-de-securite\/\">Op\u00e9rations de s\u00e9curit\u00e9<\/a><\/p>\n\n\n<div class=\"wp-block-group nrn2-service-top nrn2-hero-layout-r3 is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-hero-split-copy is-layout-flow wp-block-group-is-layout-flow\">\n\n<p class=\"nrn2-kicker wp-block-paragraph\">SOC \/ SOC-03<\/p>\n\n\n<h1 class=\"wp-block-heading nrn2-title\">Collecte des journaux et d\u00e9ploiement du SIEM<\/h1>\n\n\n<p class=\"nrn2-lead wp-block-paragraph\">Centraliser les \u00e9v\u00e9nements de s\u00e9curit\u00e9 utiles et les rendre exploitables pour la recherche, les alertes et les investigations. Le projet aborde la qualit\u00e9, les horodatages, la r\u00e9tention et le co\u00fbt tout autant que l'installation de la plateforme.<\/p>\n\n<\/div>\n\n\n<figure class=\"wp-block-image size-full nrn2-context-image nrn2-visual-asset-service-family-soc\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"500\" src=\"https:\/\/neranis.com\/wp-content\/uploads\/2026\/09\/service-family-soc.webp\" alt=\"\" class=\"wp-image-251\" srcset=\"https:\/\/neranis.com\/wp-content\/uploads\/2026\/09\/service-family-soc.webp 1600w, https:\/\/neranis.com\/wp-content\/uploads\/2026\/09\/service-family-soc-300x94.webp 300w, https:\/\/neranis.com\/wp-content\/uploads\/2026\/09\/service-family-soc-1024x320.webp 1024w, https:\/\/neranis.com\/wp-content\/uploads\/2026\/09\/service-family-soc-768x240.webp 768w, https:\/\/neranis.com\/wp-content\/uploads\/2026\/09\/service-family-soc-1536x480.webp 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\" \/><\/figure>\n<\/div>\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-service-top is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-service-intro is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">QUAND C'EST UTILE<\/p>\n\n\n<h2 class=\"wp-block-heading nrn2-h2\">Une r\u00e9ponse cibl\u00e9e<br>\u00e0 un besoin d\u00e9fini.<\/h2>\n\n\n<p class=\"nrn2-body-lg wp-block-paragraph\">Journaux \u00e9parpill\u00e9s ou perdus, besoin d'enqu\u00eate post-incident, pr\u00e9paration du SOC ou plateforme co\u00fbteuse ing\u00e9rant trop de donn\u00e9es de faible valeur.<\/p>\n\n\n<div class=\"wp-block-buttons nrn2-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/neranis.com\/fr\/contact\/\">Discutez de ce service<\/a><\/div>\n\n<\/div>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-facts is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">EN UN COUP D'\u0152IL<\/p>\n\n\n<p class=\"wp-block-paragraph\"><strong>Famille<\/strong><br><a href=\"https:\/\/neranis.com\/fr\/expertise\/operations-de-securite\/\">Op\u00e9rations de s\u00e9curit\u00e9<\/a><\/p>\n\n\n<p class=\"wp-block-paragraph\"><strong>Engagement<\/strong><br>Service ou mise en \u0153uvre<\/p>\n\n\n<p class=\"wp-block-paragraph\"><strong>R\u00e9f\u00e9rence<\/strong><br>SOC-03<\/p>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section nrn2-canvas is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-section-heading is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">PORT\u00c9E ET R\u00c9SULTATS<\/p>\n\n\n<h2 class=\"wp-block-heading nrn2-h2\">Ce que couvre la mission.<\/h2>\n\n<\/div>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-delivery-grid is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-delivery-card is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Port\u00e9e<\/h3>\n\n\n<ul class=\"wp-block-list nrn2-list\">\n<li>Sources et objectifs<\/li>\n\n\n<li>collecte fiable<\/li>\n\n\n<li>horodatages<\/li>\n\n\n<li>analyse syntaxique<\/li>\n\n\n<li>normalisation<\/li>\n\n\n<li>contr\u00f4le d'acc\u00e8s<\/li>\n\n\n<li>r\u00e9tention<\/li>\n\n\n<li>rechercher<\/li>\n\n\n<li>alertes prioritaires<\/li>\n\n\n<li>volume<\/li>\n\n\n<li>r\u00e9cup\u00e9ration et op\u00e9rations<\/li>\n\n<\/ul>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-delivery-card is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Livrables<\/h3>\n\n\n<ul class=\"wp-block-list nrn2-list\">\n<li>Architecture de collection<\/li>\n\n\n<li>catalogue source<\/li>\n\n\n<li>r\u00e8gles de conservation<\/li>\n\n\n<li>tableaux de bord de la qualit\u00e9<\/li>\n\n\n<li>recherches initiales et alertes<\/li>\n\n\n<li>documentation<\/li>\n\n\n<li>mod\u00e8le de capacit\u00e9 et de co\u00fbt mesur\u00e9s<\/li>\n\n<\/ul>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-delivery-card nrn2-evidence is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Preuve de r\u00e9ception<\/h3>\n\n\n<p class=\"wp-block-paragraph\">Un \u00e9v\u00e9nement de bout en bout peut \u00eatre recherch\u00e9 avec l'heure correcte ; la perte de source ou le silence est d\u00e9tect\u00e9 ; l'acc\u00e8s est restreint ; la conservation respecte le contrat ; le volume de r\u00e9f\u00e9rence et le co\u00fbt sont mesur\u00e9s.<\/p>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-section-heading is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">LIVRAISON<\/p>\n\n\n<h2 class=\"wp-block-heading nrn2-h2\">Comment le travail est structur\u00e9.<\/h2>\n\n<\/div>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-two-col is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-prose is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Approche<\/h3>\n\n\n<p class=\"wp-block-paragraph\">D\u00e9finir le p\u00e9rim\u00e8tre du service et des r\u00f4les ; connecter et valider les donn\u00e9es ; tester les sc\u00e9narios ; d\u00e9marrer les op\u00e9rations ; mesurer et am\u00e9liorer.<\/p>\n\n\n<h3 class=\"wp-block-heading\">Pr\u00e9requis et responsabilit\u00e9s<\/h3>\n\n\n<p class=\"wp-block-paragraph\">Client : actifs, journaux, contacts et autorit\u00e9 de r\u00e9ponse. Fournisseur : collecte\/analyse selon le contrat. Les d\u00e9cisions op\u00e9rationnelles et la reprise sont explicitement attribu\u00e9es.<\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-prose is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Facteurs de port\u00e9e<\/h3>\n\n\n<p class=\"wp-block-paragraph\">Actifs, sources, \u00e9v\u00e9nements, volume, r\u00e9tention, int\u00e9grations, heures et niveau de r\u00e9ponse. Int\u00e9gration, licences, consommation et service r\u00e9current s\u00e9par\u00e9s.<\/p>\n\n\n<h3 class=\"wp-block-heading\">Questions \u00e0 clarifier<\/h3>\n\n\n<p class=\"wp-block-paragraph\">Quelles questions les journaux doivent-ils r\u00e9soudre ? Quels sont les volumes r\u00e9els ? Quelles r\u00e8gles de conservation, d'acc\u00e8s et quel budget de fonctionnement s'appliquent ?<\/p>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section nrn2-compact is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-boundaries is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">LIMITES IMPORTANTES<\/p>\n\n\n<p class=\"nrn2-body-lg wp-block-paragraph\">Un SIEM n'est pas une \u00e9quipe SOC et syslog n'est pas automatiquement un SIEM. Les licences, la conservation, les performances et les frais de stockage\/transfert n\u00e9cessitent une tarification distincte.<\/p>\n\n\n<p class=\"wp-block-paragraph\">Heures et temps de r\u00e9ponse uniquement apr\u00e8s approbation contractuelle. Aucun taux de d\u00e9tection ni de r\u00e9solution garanti ; les lacunes de collecte et les sources d\u00e9faillantes restent visibles dans les rapports.<\/p>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-section-heading is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">EN PRATIQUE<\/p>\n\n\n<h2 class=\"wp-block-heading nrn2-h2\">Situations illustratives.<\/h2>\n\n<\/div>\n\n\n<p class=\"nrn2-section-lead wp-block-paragraph\">Ces exemples d\u00e9crivent des engagements possibles et des r\u00e9sultats cibles. Il ne s'agit pas de r\u00e9f\u00e9rences clients ni de r\u00e9sultats obtenus.<\/p>\n\n<\/div>\n\n\n<details class=\"wp-block-details nrn2-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Sc\u00e9nario 01<\/summary>\n<p class=\"wp-block-paragraph\">Une entreprise ne peut pas reconstituer un acc\u00e8s suspect. Projet : centraliser les \u00e9v\u00e9nements li\u00e9s aux identit\u00e9s, aux pare-feu et aux serveurs critiques. R\u00e9sultat vis\u00e9 : une chronologie exploitable pour les syst\u00e8mes couverts, sans pr\u00e9tendre reconstituer des \u00e9v\u00e9nements jamais collect\u00e9s.<\/p>\n\n<\/details>\n\n\n<details class=\"wp-block-details nrn2-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Sc\u00e9nario 02<\/summary>\n<p class=\"wp-block-paragraph\">Un SOC ing\u00e8re des journaux \u00e0 volume \u00e9lev\u00e9 et \u00e0 faible utilisation. Projet : mesurer les sources et s\u00e9lectionner les \u00e9v\u00e9nements requis par les cas d'usage de d\u00e9tection. R\u00e9sultat vis\u00e9 : des co\u00fbts mieux ma\u00eetris\u00e9s ; les suppressions sont \u00e9valu\u00e9es pour \u00e9viter de perdre des preuves utiles.<\/p>\n\n<\/details>\n\n\n<details class=\"wp-block-details nrn2-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Contexte technologique et de r\u00e9f\u00e9rence<\/summary>\n<p class=\"wp-block-paragraph\">Splunk Enterprise Security ou un autre SIEM adapt\u00e9 ; collecte par syslog\/API\/agent selon les sources et les autorisations disponibles.<\/p>\n\n\n<p class=\"wp-block-paragraph\">L'ensemble final des technologies est convenu lors du cadrage, sur la base de l'interop\u00e9rabilit\u00e9, des licences, des droits d'acc\u00e8s et des exigences op\u00e9rationnelles.<\/p>\n\n<\/details>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-section-heading is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">SERVICES CONNECT\u00c9S<\/p>\n\n\n<h2 class=\"wp-block-heading nrn2-h2\">Construisez l'\u00e9tape suivante.<\/h2>\n\n<\/div>\n\n\n<p class=\"nrn2-section-lead wp-block-paragraph\">Ces services peuvent compl\u00e9ter la mission. Ils ne sont pas inclus automatiquement.<\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-related-grid is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-service-card is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-ref wp-block-paragraph\">SOC-04<\/p>\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/neranis.com\/fr\/services\/ingenierie-de-detection-et-amelioration-des-regles\/\">Ing\u00e9nierie de la d\u00e9tection et am\u00e9lioration des r\u00e8gles<\/a><\/h3>\n\n\n<p class=\"nrn2-card-desc wp-block-paragraph\">Concevoir et maintenir des r\u00e8gles de d\u00e9tection li\u00e9es aux risques clients, avec des proc\u00e9dures de test et d'investigation. L'objectif est d'obtenir des alertes utiles et explicables plut\u00f4t qu'un catalogue incontr\u00f4l\u00e9 de r\u00e8gles activ\u00e9es.<\/p>\n\n\n<p class=\"nrn2-text-link wp-block-paragraph\"><a href=\"https:\/\/neranis.com\/fr\/services\/ingenierie-de-detection-et-amelioration-des-regles\/\">D\u00e9couvrir ce service <span aria-hidden=\"true\">\u2197<\/span><\/a><\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-service-card is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-ref wp-block-paragraph\">RES-02<\/p>\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/neranis.com\/fr\/services\/contrat-de-preparation-et-dassistance-en-cas-dincident\/\">Contrat d'assistance et de pr\u00e9paration \u00e0 la r\u00e9ponse aux incidents<\/a><\/h3>\n\n\n<p class=\"nrn2-card-desc wp-block-paragraph\">Pr\u00e9parer les contacts, les autorisations, les acc\u00e8s et les proc\u00e9dures avant un incident pour \u00e9viter les retards lors de l'activation. Un contrat de services (retainer) pr\u00e9cise les conditions d'assistance ; il ne doit pas \u00eatre vendu comme une intervention garantie sans engagement formel.<\/p>\n\n\n<p class=\"nrn2-text-link wp-block-paragraph\"><a href=\"https:\/\/neranis.com\/fr\/services\/contrat-de-preparation-et-dassistance-en-cas-dincident\/\">D\u00e9couvrir ce service <span aria-hidden=\"true\">\u2197<\/span><\/a><\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-service-card is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-ref wp-block-paragraph\">PEN-09<\/p>\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/neranis.com\/fr\/services\/red-teaming-violet-et-validation-des-controles\/\">Purple teaming et validation des contr\u00f4les<\/a><\/h3>\n\n\n<p class=\"nrn2-card-desc wp-block-paragraph\">Travail conjoint entre testeurs et d\u00e9fenseurs pour v\u00e9rifier que le comportement malveillant simul\u00e9 produit les signaux et les r\u00e9ponses attendus.<\/p>\n\n\n<p class=\"nrn2-text-link wp-block-paragraph\"><a href=\"https:\/\/neranis.com\/fr\/services\/red-teaming-violet-et-validation-des-controles\/\">D\u00e9couvrir ce service <span aria-hidden=\"true\">\u2197<\/span><\/a><\/p>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-cta is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">Commencer une conversation<\/p>\n\n\n<h2 class=\"wp-block-heading nrn2-h2\">Clarifiez la port\u00e9e.<\/h2>\n\n<\/div>\n\n\n<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-body-lg wp-block-paragraph\">Nous clarifierons l'objectif, les d\u00e9pendances et les responsabilit\u00e9s de ce service avant de proposer la livraison.<\/p>\n\n\n<div class=\"wp-block-buttons nrn2-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/neranis.com\/fr\/contact\/\">Discutez de vos priorit\u00e9s<\/a><\/div>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/section>","protected":false},"excerpt":{"rendered":"<p>Centraliser les \u00e9v\u00e9nements de s\u00e9curit\u00e9 utiles et les rendre exploitables pour la recherche, les alertes et les investigations. Le projet aborde la qualit\u00e9, les horodatages, la r\u00e9tention et le co\u00fbt tout autant que l'installation de la plateforme.<\/p>","protected":false},"featured_media":0,"template":"single-nrn_service","meta":{"footnotes":""},"nrn_family":[15],"class_list":["post-130","nrn_service","type-nrn_service","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/nrn_service\/130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/nrn_service"}],"about":[{"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/types\/nrn_service"}],"version-history":[{"count":2,"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/nrn_service\/130\/revisions"}],"predecessor-version":[{"id":525,"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/nrn_service\/130\/revisions\/525"}],"wp:attachment":[{"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/media?parent=130"}],"wp:term":[{"taxonomy":"nrn_family","embeddable":true,"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/nrn_family?post=130"}],"curies":[{"name":"Bien jou\u00e9","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}