We see the attackwhile it is happening.
Turnkey security monitoring for companies and government bodies in Kazakhstan: KEMEL's own SIEM platform and the team that runs it. Logs and evidence for the personal data law are collected automatically.
The agent installs in one day. Data stays in Kazakhstan.
- Source
- web-01 · 203.0.113.7
- Request
- GET /.git/config
- User-Agent
- python-requests/2.32
- Time
- 03:14:07 (Almaty)
03:14. Someone is reading your /.git/config. Who will notice?
log lines from a single web server per day
An attacker's reconnaissance looks like any other line. Without monitoring, nobody will read it. An in-house on-duty shift means several specialists.
200 squares instead of 14,238 lines. One of them is the /.git/config request.
We collect everything
where an attack can begin
Logs from servers, web servers, applications, containers and the network — in one search and under one set of rules.
The agent opens an outbound mTLS connection to 443 itself and works through a proxy.
Fluent Bit and osquery barely load the server. Measured in a pilot.
With check-digit validation. Phone numbers and e-mails are masked too.
Every event is checked against the rules
The open Sigma standard: SigmaHQ community rules plus our own — for web, applications, Linux and Supabase.
title: Probe For Secret Files Over HTTP
logsource:
category: web
detection:
selection_path:
url.path|endswith:
- '/.env'
- '/.aws/credentials'
- '/.git/config' - '/wp-config.php.bak'
condition: 1 of selection_*
level: medium- no matchGET /catalog?page=2 → 200203.0.113.24
- no matchsshd: Accepted publickey for deploy198.51.100.12
- no matchPOST /api/cart → 201203.0.113.91
- MEDIUMGET /.git/config → 404 · python-requests/2.32203.0.113.7
Synthetic data, addresses from documentation ranges.
We write and tune rules for your applications. That is how our 14 own rules came about.
With a SIEM and no people, your engineer will have to write and tune them.
An alert won't get lost in your inbox
A notification with an Ack button, plus e-mail. If nobody responds, escalation follows the SLA with a delivery log.
- 103:14Alert createdTo the on-duty analyst and by e-mail.
- 2+15 minNo AckEscalates to the next person on the schedule.
- 3+30 minStill nothingTo the manager. Every delivery is logged.
If a source goes quiet, we tell you, rather than passing silence off as calm.
Escalation intervals are an example; they are set in the policy.
You decide who presses Ack
You can take the platform alone, or together with the KEMEL.TECH team that stands watch for you.
Your IT responds
- 03:14
Your engineer receives an alert with ready context: IP, request, User-Agent, file or process.
- 03:15
Presses Ack and investigates in the console: a search across all sources for the minutes before and after.
- morning
Adds the finding to the vulnerability register, with a deadline and an owner.
A KEMEL.TECH on-duty analyst responds
- 03:14
Our on-duty analyst receives the alert. Your IT sleeps.
- 03:15
We triage: false positives we close ourselves; for a real threat we call you and help contain it.
- later
The finding goes to the register, then a retest and an acceptance report after the fix. Response times are in the contract.
Management sees numbers, not impressions
Daily, weekly and monthly reports: how many alerts, how quickly we responded, what is still open.
- Probe For Secret Files9
- Recon User-Agents6
- Path Traversal3
- SSH brute force2
- Agent went silent1
Time to respond and time to close come from the log, not from anyone's word.
Vulnerabilities and retest reports with deadlines and statuses.
Every operator action is recorded. MFA for administrators, tenants are separated.
The report figures are a synthetic example. A report with a register and retests is analyst hours; with a SIEM and no people, your employee spends them.
The personal data law requires you to prove that you respond to incidents
In the event of a leak, the authorised body must be notified within one business day. To do that, the event has to be noticed and there has to be a log that confirms the timing.
The law does not require monitoring. Access and event logs must be kept, and SIEM does this automatically.
You need an incident response procedure, vulnerability analysis and internal control. SIEM provides the evidence: who responded and when.
The law explicitly requires cybersecurity event monitoring, a security assessment, a pentest and an independent audit.
Who the platform is for
Online shops, fintech, healthcare, education, logistics: you have a website, a customer account area and a client database.
GUARD plansThe category is determined for each legal entity separately. You need a single console and a framework agreement.
For groups of companiesThe platform is deployed inside your perimeter (on-prem), and data never leaves it.
GUARD GovPlatform, people and data in Kazakhstan. In one place.
You usually have to choose: a global platform without people, or a service with people but with data abroad.
| Criterion | Global SIEMs a platform without people | Boxed SIEMs you do everything yourself | Foreign MDR people included, data abroad | KEMEL GUARD SIEM and team together |
|---|---|---|---|---|
Monitoring platform collects logs and catches attacks | ||||
Specialists respond for you triage alerts and false positives | ||||
Data stored in Kazakhstan SaaS in Kazakhstan or inside your perimeter | ||||
Personal data law documents journals and inspection readiness |
- Monitoring platform
- Specialists respond for you
- Data stored in Kazakhstan
- Personal data law documents
- Monitoring platform
- Specialists respond for you
- Data stored in Kazakhstan
- Personal data law documents
- Monitoring platform
- Specialists respond for you
- Data stored in Kazakhstan
- Personal data law documents
- Monitoring platform
- Specialists respond for you
- Data stored in Kazakhstan
- Personal data law documents
Comparison by type of solution, not by specific product. The rating is approximate.
You install the agent. We do the rest under the contract.
Install and name
- 1Install the agent, or give us access and we install it ourselves.
- 2Tell us whom to call if the attack is real.
No inbound ports, no server of your own, no hiring of analysts.
We do the rest
- 1We connect sources and work out log formats
- 2We mask IINs, phone numbers and e-mails before they are written
- 3We write and tune rules for your applications
- 4We remove false positives so an alert means something
- 5We make sure agents stay connected
- 6We stand watch on schedule and respond within contract deadlineswith team
- 7We keep the vulnerability register, run the retest and issue the acceptance reportwith team
- 8A pentest every quarter and vCISOwith team
- 9A monthly report to management
- 10We store data in Kazakhstan
Free and low-cost SIEMs do not cover rules, on-call duty and triage: those stay with you. We sell a caught attack.
Global SIEM and MDR services have no site in Kazakhstan. We offer SaaS in Kazakhstan or installation inside your perimeter.
Response times and responsibility for them are written into the contract, not promised verbally.
A two-week pilot: pentest first, then protection
- Days 1–3
Pentest: we find the vulnerabilities in your systems the way an attacker would.
- Day 4
We switch on the agent: outbound connection on 443, no inbound ports. We connect sources and mask personal data.
- Days 5–13
Record and tune: findings go to the register, rules are adapted to your systems, less noise, retest.
- Day 14
Pilot report: what we found, what we caught, what was fixed, what to connect next.
SIEM questions
What is SIEM KEMEL GUARD?
It is KEMEL's own security monitoring platform and the team that runs it. The platform collects logs from servers, web servers, applications, containers and the network, checks every event against Sigma rules and sends alerts to the on-duty analyst, with escalation if nobody responds. Management receives reports on response time and open findings.
What do I need to install, and do I have to open ports?
You install an agent (Fluent Bit and osquery). It opens an outbound mTLS connection to port 443 on its own; no inbound ports need to be opened. The agent installs in one day: you install it yourself or give us access and we install it for you.
How does the pilot work?
The pilot lasts 14 days. In the first days we run a pentest and find vulnerabilities in your systems, then switch on the agent, connect sources and mask personal data. Next we record findings in the register and tune the rules to your systems. At the end you receive the pilot report: what we found, what we caught, what was fixed and what to connect next.
Can I take just the platform, without your team?
Yes. You can take the platform alone, in which case your IT department responds to alerts. The “platform and team” option means alerts go to a KEMEL.TECH on-duty analyst, and response times are set out in the contract.
Does personal data end up in the logs, and what happens to it?
Security logs contain IP addresses, logins, full names and sometimes IINs. IINs (with check-digit validation), phone numbers and e-mails are masked before being written. This matters because such fields are themselves personal data.
Is the platform suitable for government bodies?
For government bodies, the quasi-public sector and owners of critical ICT infrastructure there is GUARD Gov: the KEMEL platform is deployed on-prem inside the customer's perimeter, and data never leaves it.
How much does it cost?
KEMEL WATCH monitoring is included in GUARD Pro from 500,000 ₸ per month. For large companies (GUARD Ultra) and government bodies (GUARD Gov) the price is discussed individually. The final price depends on volume and is fixed in the contract.
Tell us about your task — we will call back within 2 hours
We will advise where to start and answer your questions about the personal data law. No obligations.
- 1You leave your number
- 2We call and clarify the task
- 3We send a proposal and an NDA contract