Hello,
I would like to discuss a scenario where an MPLS provider have a large no of provider owned CPEs. These are edge devices which connects to customer devices. We donot have access to the core network.
Question:
1) Is it worth monitoring the CPEs via SIEM when we are not coorelating the logs from the core side? What are the type of use cases we can address?
2) Is hardening the devices and using a complaince management tool to ensure efectiveness of controls enough without SIEM monitoring?
3) Can someone give references of the big MPLS player - if they use SIEM monitoring for their CPE devices?
