How RedLegg Helped an International Law Firm Build Its SOC with Co-Managed SIEM

Case Study · LEGAL  

See how RedLegg helped an international law firm establish 24/7 security monitoring, strengthen client data protection, and build a foundation for its Security Operations Center through co-managed SIEM. 
Executive Summary

Building a Security Operations Center with Co-Managed SIEM  

For an international law firm, protecting sensitive client information was closely tied to maintaining client trust, meeting compliance expectations, and supporting long-term business growth.

When the firm's Head of Information Security joined as its first security manager, the organization had no Security Information and Event Management (SIEM) platform and no dedicated team regularly monitoring its environment. Building an internal security operations team would have required hiring four to five additional employees.

The firm partnered with RedLegg to establish a co-managed SIEM environment using LogRhythm. Through log ingestion, RedLegg's security content package, 24/7 monitoring, and analyst-led event escalation, the organization began building the visibility and operational capabilities needed for its Security Operations Center (SOC).

RedLegg's flexible approach provided consistent security expertise without requiring the firm to fully outsource its daily security operations. This allowed the Head of Information Security to shift more attention toward future security planning while supporting client data protection and business objectives.

GettyImages-664648035-71877a8c76914ebab884a00546a76c81
THE CHALLENGE

Establishing Security Visibility Without Expanding Internal Staffing

When the Head of Information Security joined the international law firm, there was no SIEM platform or established team responsible for continuously monitoring the organization's environment.

The security leader was responsible for governance, risk management, compliance, security technologies, and day-to-day operations. Establishing an internal SOC would have required hiring four to five additional employees, creating staffing and budget challenges.

At the same time, protecting client information was becoming increasingly important to the firm's business strategy. Clients were implementing vendor management programs and requiring stronger assurances about data protection and compliance.

The firm needed a cost-effective way to establish continuous security monitoring, maintain client confidence, and build a foundation that could support future growth.

WHY REDLEGG

The firm needed a cost-effective security partner that could provide consistent analyst support and a flexible approach to SIEM management.

RedLegg's co-managed model offered the expertise and operational support required to establish continuous monitoring while allowing the internal security team to focus on future priorities.

SOLUTION / AUTOMATION WORKFLOW

The firm partnered with RedLegg to implement and co-manage a LogRhythm SIEM platform, establishing the visibility needed to begin building its SOC.

Logs were ingested into the platform, and RedLegg's security content package was deployed to align with the firm's visibility strategy.

Through the co-managed model, RedLegg provided 24/7 monitoring and analyst-led event escalation based on procedures established during onboarding.

As the firm's security operations developed, the platform was expanded with automation, additional security content, and new visibility use cases.

.

LOG INGESTION 
Logs were ingested into the SIEM platform to establish security visibility. 
REDLEGG CONTENT PACKAGE 
Security content was deployed to support the firm's visibility strategy. 
24/7 MONITORING 

RedLegg's co-managed model provided continuous security monitoring. 

EVENT ESCALATION

Expert analysts escalated security events according to procedures established during onboarding. 


ONGOING DEVELOPMENT 
The firm expanded its platform through automation, additional security content, and visibility use cases. 
“
“With RedLegg, I could shift my focus to planning for future security needs.”  
 Head of Information Security, International Law Firm 
IMPLEMENTATION 

RedLegg and the firm's security team implemented a co-managed SIEM environment using LogRhythm.

The deployment included log ingestion and the installation of RedLegg's security content package to support the firm's visibility strategy.

Event escalation procedures were established during onboarding, enabling RedLegg's analysts to provide continuous monitoring and communicate security events according to the agreed plan.

THE BENEFITS

More Flexibility

Starting with a new SIEM implementation allowed the firm to select a flexible approach that could accommodate future security requirements and growth.

Lower Costs

The firm needed a cost-effective solution that would strengthen its security operations without requiring the budget associated with fully outsourcing day-to-day security management. RedLegg's co-managed approach addressed that need.

Consistent Talent

RedLegg provided access to consistent security analyst expertise, reducing the staffing burden on the Head of Information Security and allowing greater focus on strategic security planning.

HOW IT WAS DELIVERED

CO-MANAGED SIEM 

RedLegg and the firm's security team implemented LogRhythm with security correlation tools, reporting, and event updates to support day-to-day security operations.  and security support. 

P24/7 VISIBILITY 

RedLegg provided continuous monitoring, with expert analysts escalating security events according to procedures established during onboarding. 

STAFFING & LEGACY TUNING

RedLegg extended the firm's internal security capabilities through consistent analyst support and customized tuning aligned with its existing environment. 
“

“A big concern was man power: staffing and talent consistency. But with RedLegg, I could shift my focus to planning for future security needs”

Head of Information Security, International Law Firm 

CONCLUSION

RedLegg helped the international law firm establish a foundation for its Security Operations Center while supporting its broader business and security objectives.

Through a co-managed SIEM environment, continuous monitoring, consistent analyst expertise, and ongoing platform development, the firm strengthened its ability to protect client information and respond to security concerns.

The flexible partnership also enabled the Head of Information Security to focus on future security planning rather than the challenges of building and staffing an internal SOC.

With a renewed contract, RedLegg continues to support the firm's long-term security goals, helping maintain client confidence while the organization develops its security capabilities.

IMPACT
  • Client Assurance: Strengthened the firm's ability to address client questions and concerns about data protection. 
  • 24/7 Security Visibility: Established continuous monitoring through a co-managed SIEM environment. 
  • Consistent Security Expertise: Provided analyst support without requiring the firm to build a four-to-five-person internal SOC team. 
  • Future Security Planning: Enabled the Head of Information Security to shift attention toward future security priorities. 
  • Flexible SOC Development: Supported expansion through automation, additional security content, and new visibility use cases. 
  • Long-Term Business Support: Continued the security partnership through a renewed contract, supporting the firm's business objectives. 
“
“I'm more confident that we made the right choice by working with RedLegg because they are continuously looking to improvise and improve their processes. We have common goals.” 
Head of Information Security, International Law Firm 
CASE STUDIES

More stories from RedLegg clients

pexels-brett-sayles-4508751
Case Study
Improving Enterprise Security Visibility with SIEM 

See how RedLegg helped an insurance company strengthen security visibility and monitoring through a co-managed SIEM approach. 

Read Now
next arrow
images (6)
Case Study
Building a Security Operations Center for an International Law Firm 

See how RedLegg helped an international law firm build its Security Operations Center (SOC) with SIEM services and specialized security expertise. 

Read Now
next arrow
manufactura-1
Case Study
Scaling Security Automation Across Enterprise Operations 

See how RedLegg supported Albemarle's security automation capabilities through a co-managed SOAR approach. 

Read Now
next arrow