Insights

What 'all-inclusive SIEM' should mean: a buyer's checklist | Evelcra

sales@evelcra.com (Evelcra Team) — Mon, 19 Oct 2026 07:14:27 GMT

Many SIEM proposals look complete on the first page and expensive by the last. The core platform is quoted, then come the line items: behavioural analytics, automated response, threat-intelligence feeds, detection content, collectors, compliance reporting. Each may be licensed, metered and renewed separately.

"All-inclusive" is a useful promise, but only if you know what to check. This checklist is meant to help security and procurement teams compare SIEM offers on the same basis, whichever vendor they choose.

1. Licensing: what is metered, and what is extra?

Most SIEMs are sized on events per second (EPS), data volume or both. That is reasonable: ingest and retention drive hardware and storage. The question is what else is metered on top.

Is the licence one platform price, or a base price plus separately licensed modules?
Are any features unlocked per EPS tier, so that growth triggers a feature true-up as well as a capacity one?
Is detection content included, or is it a separate subscription?
What happens to detection if a renewal is late? Does correlation stop, or carry on?

Tip: ask for your current renewal quote and list every line item. Then ask each new vendor which of those lines they include.

2. UEBA, SOAR and threat intelligence: included or add-on?

These three capabilities are where costs often grow after the initial purchase.

UEBA: how many behavioural models ship as standard? Is per-user risk explainable, showing which factors drove the score?
SOAR: is automated response part of the same console, or a separate product with its own integration project? How many response actions are built in, and can playbooks require human confirmation before critical steps?
Threat intelligence: are indicators bundled and matched inline, or does every feed require its own subscription?
Case management: can incidents be worked inside the SIEM, or do you need an external ticketing system?

3. Agents and collectors: what does onboarding cost?

For endpoints and servers without a log forwarder, the agent or collector tier can become a significant, ongoing cost.

Are agents licensed per endpoint or per collector?
Is agent traffic encrypted, and does it buffer locally if the network link drops?
Are agents managed and updated centrally from the server?

4. Deployment: on-premise and air-gap

Regulated and critical-infrastructure environments often cannot send logs to a third-party cloud.

Can the platform run fully on-premise, with no mandatory cloud dependency?
Can it run in an air-gapped network, including upgrades delivered offline?
Are optional cloud services, such as AI assistants or online feeds, genuinely optional?
How are high availability and disaster recovery delivered, and how many systems does that add?

5. Day-two effort: who keeps it useful?

The licence is only part of the cost. A SIEM that floods analysts with false positives on day one, or needs a dedicated rule-engineering team, is expensive to run.

How does the vendor help you decide which detections to enable for your environment?
Can new rules run in an observe-only mode before they raise incidents?
Does the platform monitor its own health?

6. Evidence and interoperability

Are compliance report packs included, and are reports tamper-evident?
Is there an immutable audit trail of operator actions?
Can events be forwarded to an existing SIEM or data lake, and is there a documented API?

Where NflowX fits

NflowX is Evelcra's self-managed SIEM. It was designed around the questions above.

One all-inclusive platform licence. Sized from a sample of your real logs, using events per second and retention to set the node count. UEBA, SOAR, threat intelligence, compliance reporting, passive asset discovery and case management are in the base licence, with no per-feature metering. An AI assistant is available as an optional module.
Detection content included. 3,437 correlation rules installed, 1,695 enabled by default, mapped to 395 MITRE ATT&CK techniques, with no separate content subscription.
UEBA: 31 behavioural models, with explainable, time-decaying per-user risk that shows the top contributing factors.
SOAR: 51 built-in response actions, such as blocking an IP, isolating a host or disabling an account, with branching playbooks and confirmation gates.
Threat intelligence: more than 30,000 bundled indicators matched inline, plus GeoIP and on-demand enrichment.
Free agents. Windows and Linux agents at zero licence cost, encrypted, buffered during network outages, managed centrally, with a per-agent host-footprint measure.
On-premise and air-gap ready. Runs fully offline with offline upgrades; threat-intelligence feeds and the AI assistant are optional. A replicated peer at a second site provides high availability and geographic disaster recovery.
Less tuning. A passive Learning Mode recommends which rules to activate based on your actual traffic, rules can run live, audit-only or disabled, and a Platform Health board checks every internal service.
Evidence and interoperability. Report packs and control mappings for frameworks including PCI DSS, ISO 27001, HIPAA, GDPR and NIST 800-53, delivered as cryptographically signed PDFs; events can be forwarded in OCSF format to an existing SIEM or data lake, and a REST API is documented with an OpenAPI specification.

Use the checklist

Take your current SIEM quote, run it through the six sections above, and mark each item as included, add-on or not available. The result is a like-for-like view that is far more useful than a headline price.

If you would like to compare NflowX against your current setup, request an NflowX demo and share a log sample for sizing. MSSPs and SOC providers looking for free agents and one predictable licence can learn about partnering with Evelcra.

IT and OT compliance in one place: why IEC 62443 changes the GRC conversation | Evelcra

sales@evelcra.com (Evelcra Team) — Mon, 19 Oct 2026 07:14:25 GMT

For years, IT compliance and OT security have lived in different worlds. The compliance team runs ISO 27001, NIS2 or PCI DSS in a GRC tool that has never seen a PLC. The engineering team secures the plant against IEC 62443 in spreadsheets and drawings that never reach the auditor. Both are doing serious work, but nobody holds a single picture of risk.

That split is getting harder to defend. Regulation now asks organisations to answer for the operational technology that runs the business as well as for enterprise IT, and boards want one answer, not two. IEC 62443 is a big part of why the GRC conversation is changing.

What IEC 62443 asks for, in brief

IEC 62443 is a series of international standards for the security of industrial automation and control systems. Without going clause by clause, a few ideas stand out for anyone used to IT-centric frameworks:

Zones and conduits. The system is divided into zones of assets with similar security requirements, connected by conduits that carry communication between them. Security is designed and assessed per zone and per conduit, not just for the site as a whole.
Security levels. Each zone or conduit is given a target security level, from 1 to 4, reflecting the kind of attacker it needs to withstand. The achieved level is then compared against that target.
System requirements. IEC 62443-3-3 sets out system security requirements linked to those levels, so the target directly drives which controls apply.
A security programme. IEC 62443-2-1 addresses the asset owner's security programme: the policies, processes and governance around the technical controls.

Why the usual tooling struggles

Most organisations end up with a gap between two good but separate sets of tools:

GRC suites stop at the firewall. They handle IT frameworks, policies and audits well, but they were not designed to model zones, conduits or per-cell security levels.
OT security tools watch the plant. They are strong at visibility and detection on industrial networks, but they do not usually manage multi-framework compliance, audit evidence or business continuity.
Spreadsheets fill the gap. Zone and conduit assessments sit in engineering files, disconnected from the risk register and the evidence the auditor reviews.

The result is an accountability gap. OT risk is invisible to governance, IT risk ignores the plant, and risk ratings become assertions rather than something you can trace and defend.

What a converged approach looks like

If you are an OT or industrial security lead, these are the questions worth asking of any approach, whether tooling or process:

Is there one model of assets, threats, controls and owners that both IT and OT are assessed against?
Can the plant be modelled as it really is, with zones containing nested cells, across Purdue levels, and conduits assessed as well as zones?
Are security level targets derived from evidence, such as consequence, attacker capability and exposure, rather than simply declared?
Do applicable IEC 62443-3-3 requirements and gaps follow from the target, compared against the controls you actually have in place?
Does an IEC 62443 control count towards other frameworks where it overlaps, such as ISO 27001 or NIS2, so the evidence is gathered once?
Is risk re-assessed when things change, for example a new vulnerability or an end-of-life controller, rather than once a year?

Where NormSentry fits

NormSentry is Evelcra's security, risk and compliance platform, designed to cover enterprise IT and OT/ICS in one system of record.

IEC 62443 built in. Zone, conduit and cell assessment, with cells grouped and governed across Purdue levels 0 to 5. Cells can be nested within zones and each is risk-assessed on its own, then rolled up to its parent.
SL-T derived, not declared. For every cell, conduit and zone, a target security level (SL-T 1 to 4) is computed as the maximum of independent floors covering consequence, attacker capability, boundary exposure, regulatory relevance and organisational policy, so the target reflects the worst-case driver rather than an average.
Requirements and gaps per cell. Applicable IEC 62443-3-3 requirements are generated per cell and compared against live control posture, with a visual topology map and controlled assessment documents in DOCX or PDF.
Both parts of the standard. Framework packs cover IEC 62443-3-3 (51 controls) and IEC 62443-2-1 (126 controls), on the same control schema as ISO 27001, IM8, NIST, PCI DSS, NIS2 and others, so evidence can be reused across frameworks.
One risk engine for IT and OT. A five-stage engine (impact, likelihood, inherent, residual, tolerance) re-runs on change or on schedule, org-wide or scoped to a single cell, with every score traceable to its inputs.
Exposure feeds risk. CVE findings imported from Nessus, OpenVAS or CSV are mapped to affected assets, and end-of-life and end-of-support systems are flagged in the asset register.
Deployment options. Cloud-hosted on Singapore cloud, or fully on-premise.

Start with one cell

A useful way to test any converged approach is to take one production cell you know well and walk it end to end: its assets, its conduits, how its target security level was set, which requirements apply, where the gaps are, and how that shows up in the risk register the board sees. If that journey crosses three tools and two spreadsheets, you have found your accountability gap.

To see that walk-through on your own estate, request a NormSentry demo. MSSPs and integrators serving industrial clients can learn more about partnering with Evelcra.

IM8 compliance without the spreadsheet chase | Evelcra

sales@evelcra.com (Evelcra Team) — Mon, 19 Oct 2026 07:14:22 GMT

If you look after compliance for a Singapore government supplier or a public-sector organisation, you probably know the pattern. An audit date appears in the calendar, and the next few weeks disappear into spreadsheets, shared folders and email threads, chasing screenshots, policy versions and sign-offs that were "definitely done" months ago.

IM8, the Singapore Government's instruction manual for ICT and smart systems management, is rarely the only obligation on the list. Many teams also answer to ISO 27001, keep continuity plans in line with ISO 22301, and increasingly have to show how operational technology is protected. Each framework brings its own wording, its own evidence requests and often its own spreadsheet.

Why IM8 compliance turns into a chase

The problem is rarely a lack of effort. It is usually structural:

Evidence is collected after the fact. Work happens throughout the year, but proof of it is gathered in a rush before each audit. By then, people have moved on and records are incomplete.
The same control is assessed several times. Access control, logging or change management appear in IM8, ISO 27001 and other frameworks under different names. Without a shared view, teams answer essentially the same question again and again.
Risk is assessed once a year. A point-in-time assessment goes stale the day it is signed. New vulnerabilities, configuration changes and ageing systems accumulate unseen until the next review.
Know-how lives in a few heads. Framework expertise is scarce. When one or two people hold the mapping between requirements and evidence, every audit depends on their availability.

A practical approach

None of the following requires a particular product. It is a way of organising the work so that audits become a review of what already exists, rather than a project.

1. Build one control library and map it across frameworks

Start from a single set of controls that your organisation actually operates, then map each one to the IM8, ISO 27001 and other requirements it satisfies. When the access review is done, it counts everywhere it is relevant. The aim is simple: assess a control once and reuse the evidence.

2. Capture evidence at the moment of work

Evidence is cheapest when it is recorded as part of the task: the approval on the change request, the completed recurring check, the updated asset record. Tie each piece of evidence to the control it supports and to a named owner, so nobody needs to reconstruct it later.

3. Give every recurring task an owner and a date

Many findings come from routine activities that quietly slip: quarterly reviews, plan tests, access recertifications. A compliance calendar with clear responsible and accountable owners (a RACI) turns these into visible, trackable tasks rather than things remembered just before the audit.

4. Keep a living risk register

Link risks to real assets, threats, vulnerabilities and the controls that reduce them, and re-assess when something changes rather than once a year. A register that an auditor can follow from asset to threat to control to residual risk is far easier to defend than ratings that rest on opinion.

5. Control change formally

Auditors want to see that material changes are approved by someone other than the requester and that the decision is recorded. A defined change workflow with dual approval and segregation of duties produces that record automatically.

Where NormSentry fits

NormSentry is Evelcra's governance, risk and compliance platform. It was built around the approach above, with risk assessment at its core.

IM8 supported natively. NormSentry includes an IM8 framework pack with 102 controls, alongside ISO 27001, ISO 22301, IEC 62443, NIST, PCI DSS, NIS2 and DORA, on one universal control schema of 1,068 controls in total.
Map once, satisfy many. The multi-framework crosswalk lets you assess a control once and reuse the evidence across every framework that needs it, with per-framework posture cards showing implementation status.
Continuous, traceable risk. A five-stage risk engine (impact, likelihood, inherent risk, residual risk and tolerance) re-runs on change or on a schedule. Every score is traceable to the threats, controls and assumptions behind it, and results are held in a durable risk register.
Governance built in. Change Request Forms with four-eyes approval, an approval matrix, segregation-of-duties rules, RBAC, RACI ownership and a full audit trail.
A compliance calendar. Recurring, RACI-routed cadence tasks so routine controls do not slip between audits.
Auditor access to live posture. Auditors can be given their own read-only account to review evidence-backed posture directly, instead of exported binders.
Data residency. NormSentry is built and hosted on Singapore cloud, or can be deployed fully on-premise.

NormSentry and NflowX are deployed in Singapore government-related and critical-infrastructure programmes, supporting frameworks such as IM8, ISO 27001 and IEC 62443.

A simple first step

Before buying anything, try a short exercise. List the frameworks you answer to, pick ten controls that appear in more than one of them, and count how many times each is assessed and evidenced separately each year. That number usually makes the case for a single control library on its own.

If you would like to see how this works on your own estate, request a NormSentry demo. If you are an MSSP or consultancy supporting public-sector clients, find out about partnering with Evelcra.