Architecting a 24x7 SOC in India: CERT-In 6-Hour Escalation, Wazuh SIEM & 180-Day Immutable Logs
Complete engineering blueprint for standing up an in-country 24x7 SOC in India. Covers open-source and commercial SIEM topologies (Wazuh, OpenSearch, Splunk), automated SOAR containment scripts, local sovereign data retention, and meeting the CERT-In 6-hour incident disclosure requirement.
Interactive Technical Checklist (4 Verification Checkpoints)
-
[SIEM Architecture] Configure Wazuh cluster with distributed OpenSearch indexers in AWS ap-south-1 Mumbai.Mandate: Local SIEM Cluster
-
[Time Sync] Add samay1.nplindia.org and samay2.nplindia.org to chrony/ntp.conf across all Linux servers.Mandate: NPL Clock Sync
-
[Log Retention] Configure S3 Lifecycle Rule to transition cold logs to Glacier Vault Lock after 30 days for 180-day immutability.Mandate: WORM S3 Lock
-
[Incident Playbooks] Integrate automated CERT-In Annexure-1 prefill script into SOAR incident creation pipeline.Mandate: Automated Escalation
In India, CERT-In mandates that all ICT systems synchronize clocks with National Physical Laboratory (NPL) or NIC servers to ensure forensically valid timestamps during incident investigations.
Production chrony.conf Configuration for Indian Servers
Need Accredited Auditors to Execute This Audit or Gap Assessment?
BlueCiphr's certified lead auditors (CEH Master, PenTest+, ISO 27001 Lead Auditors) conduct deep technical verification and produce board-ready evidence binders complying with RBI, SEBI CSCRF, CERT-In, and the DPDP Act 2023.