Project Spotlight: Prodigy & CNRA Modernize SOC

In an era where cyber threats are evolving at an unprecedented pace, and with an overwhelming number of cybersecurity platforms and tools available, Prodigy Consulting partnered with the California Natural Resources Agency (CNRA) to design and implement a comprehensive, agency-wide SIEM/SOAR solution built on Microsoft Sentinel. This initiative aimed to enhance their Security Operations Center (SOC) to effectively counter today’s sophisticated cybersecurity landscape.

CNRA is comprised of over 28 individual state departments, commissions, and boards, each maintaining a certain level of technological and procedural autonomy. Before the project planning, CNRA had been using an on-premises SIEM product that lacked the intelligence, scalability, and flexibility of modern cloud-based security platforms. This outdated model not only hindered the SOC’s visibility across each department’s critical infrastructure but also limited each department’s own visibility.

SIEM (Security Information and Event Management) systems aggregate and analyze activity from various resources across an organization’s IT infrastructure. They provide real-time analysis of security alerts generated by applications and network hardware. SOAR (Security Orchestration, Automation, and Response) platforms help organizations improve their security operations by automating certain tasks, orchestrating multiple tools, and facilitating incident response.

In alignment with the Cal Secure Roadmap, which is California’s multi-year cybersecurity strategy for state agencies, and the Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Architecture principles, Prodigy Consulting worked closely with CNRA to design an agency-wide, multi-tenant, enterprise SIEM/SOAR service built on Microsoft Sentinel.

Microsoft Sentinel is a cloud-native SIEM/SOAR solution that leverages the power and scalability of the cloud to provide advanced security analytics and threat intelligence across the entire organization. Given each department’s existing investments in Microsoft Azure and Microsoft 365, Microsoft Sentinel was a natural choice due to its ease of integration, lower costs for ingesting cloud logs, and extensive list of connectors for integrating with third-party log sources.

The project was executed over six months in phases, starting with the initial build-out followed by iterative onboarding of each department to the service. Prodigy developed a consistent and repeatable onboarding process that included the initial configuration of Sentinel, integration with the SOC’s “Parent” instance of Sentinel, and connecting both cloud (Azure Active Directory, Microsoft Defender, etc.) and on-premises log sources. This comprehensive service now supports all 28 CNRA departments, making it a significant accomplishment in terms of scale and complexity. 

Additionally, Prodigy provided knowledge transfer sessions for both SOC and department-level security staff on the capabilities and usage of Microsoft Sentinel. One of the key achievements of this project is the SOC’s ability to gain a “single pane of glass” visibility across all departments. This unified view allows for better monitoring, threat detection, and response capabilities, significantly enhancing the overall security posture of CNRA.