R-Vision has published a detailed account of its first participation with R-Vision SIEM at the Standoff 17 cyber battle. The system was deployed for the akPots defender team to monitor a telecom-operator infrastructure, detect attacks and investigate incidents under conditions that closely resemble a real SOC environment.
Preparation began two weeks before the event. Approximately 80 percent of the event sources used in the Standoff infrastructure were already supported natively. The remaining 20 percent required the addition of two new sources, normalization adjustments for four sources, four new correlation rules and modifications to fifteen existing rules.
During the four-day exercise the system triggered 46 correlation rules, producing more than 8.8 million correlation events and 40 thousand alerts. The most frequent detections involved behavioral analysis from PT NAD, PT Container Security events, privilege-escalation attempts, web attacks and vulnerability exploitation.
Analysts actively used the platform, creating 13 custom widgets, 14 quick filters and running more than 9,000 search queries. Average query execution time was 1.5 seconds, with the heaviest query completing in four seconds while consuming 1.58 GB of ClickHouse memory.
The deployment was sized for an expected maximum of 3,000 events per second. Actual resource usage stayed modest: the collector averaged 0.7 CPU cores and 1.9 GB RAM, never exceeding 2.9 CPU cores and 3.5 GB RAM at peak. Team members gave the product scores of 4 or 5 out of 5 and indicated they would recommend it to colleagues, citing raw-text search, the RQL query language and event-grouping capabilities as the most valuable features.
