I’m contributing to the implementation and feasibility assessment of a Wazuh SIEM for Bhutan Insurance Limited. The work brings security events into a shared monitoring environment and examines what it takes to make that environment useful, maintainable, and sustainable for the ICT team.
- Client & programme
- Bhutan Insurance Limited (BIL)
- My role
- Cybersecurity & SIEM implementation
- Collaboration
- GCIT project team & BIL ICT team
- Project status
- Implementation & assessment in progress
The problem
Bring the security picture into one place.
Servers, endpoints, and security devices each produce information that can help explain what is happening across an organisation. Reviewing those sources separately makes it harder to connect events, investigate suspicious activity, and maintain a consistent view of assets and vulnerabilities.
The BIL project focuses on centralising that visibility with an open-source Wazuh Security Information and Event Management platform. Alongside implementation, we are assessing whether it fits the organisation’s existing infrastructure, operational needs, and longer-term capacity to maintain it.
My contribution
From environment setup to usable monitoring.
My contribution covers implementation, configuration, and monitoring tests using Wazuh. I have worked on log collection, event review, alerting, and dashboards, with attention to whether the results are useful to the people operating the platform.
I also support validation and documentation with the project and client teams. Integration work, operational review, and handover remain part of the continuing project.
The monitoring workflow
A clear path from an event to an investigation.
The work connects event collection, review, and reporting into a consistent monitoring experience. The goal is to help the team investigate relevant activity and record useful findings.
Collect
Bring relevant events into a shared monitoring view so the team can examine activity consistently.
Analyse
Review events and alerts to identify activity that needs closer attention.
Investigate
Explore related information to understand the context behind a finding.
Report and follow up
Prepare understandable findings and follow-up information for the responsible team.
Implementation approach
Validate a baseline before expanding coverage.
The work follows a phased approach, using monitoring tests and review to establish a useful baseline before expanding the implementation. Feedback from the people operating the platform helps guide the next steps.
A useful monitoring system helps people distinguish relevant findings from routine activity. My work includes reviewing the clarity and usefulness of the resulting alerts and dashboards with the project team.
Monitoring priorities
Connect technical findings to operational questions.
The scope brings together several views of the same environment, helping ICT staff move from identifying a concern to understanding which systems need attention.
- Events and investigation
- Centralised logs, correlated alerts, and investigation views to help the team examine activity across monitored systems.
- Assets and vulnerabilities
- Inventory, vulnerability information, and configuration assessment to support prioritisation and follow-up.
- Operational reporting
- Understandable summaries and supporting information for reviewing monitoring activity and following up on findings.
Validation & feasibility
Assess whether the platform can be operated sustainably.
The assessment considers whether the platform is useful, reliable, maintainable, and appropriate for the team's operational needs. Monitoring tests, feedback, documentation, and handover preparation contribute to that review.
The project remains in progress. Final feasibility findings and client acceptance are still part of the delivery process.
Progress & next steps
Build the monitoring capability and the handover around it.
The implementation and monitoring tests provide a foundation for continued validation with the client team. The next priorities are reviewing the monitoring experience, completing documentation, and supporting a maintainable handover.
Completion depends on validation and client acceptance, with June 2027 recorded as the expected finish. This project is strengthening my experience in security monitoring, technical assessment, and translating findings into practical operational guidance.