Customer Story: City of Murrieta

The Challenge

The City of Murrieta needed a solution to help them get visibility into ransomware actors after an incident.

The Solution

Blumira's free SIEM allowed them to determine the scope of their ransomware incident within 10 minutes of deployment.

"I turned on the free version of Blumira and put it into our Microsoft 365 environment, and immediately we started getting information within 10 minutes that revealed we had malicious logins from other IP's outside the United States; credentials being changed."

“How do we get on top of this to prevent this from occurring again? The house was already on fire. We were trying to put it back together as fast as possible. Our major problem was getting back to business, understanding the damages that have already occurred and how we can resolve that quickly and effectively,” Amado said.  

The Solution: Fast, Easy Blumira Deployment to Detect & Prevent Further Ransomware Activity

Since it was an active event, Amado’s first priority was to mitigate the threat, as well as get ahead of the threat actors to see if they were still in the network.

“We needed something fast and quick so that we could start getting as much information compiled as possible. I turned on the free version of Blumira and put it into our Microsoft 365 environment, and immediately we started getting information within 10 minutes that revealed we had malicious logins from other IP's outside the United States; credentials being changed,” Amado said. “We discovered that it was no longer just on prem. They were moving to our cloud environments as well.”

Once the ransomware incident was contained, the City of Murrieta looked into doing full evaluation of different products to understand how they could assist them. They looked at Splunk, LogRhythm and Blumira, since they already partially implemented Blumira’s Free SIEM version. 

“It really came down to ease of use; being able to implement it within a couple hours, which we had already done prior – because like anybody in IT knows, you can have as many tools in the world as you can, but if you don't actively use them or actively look at them, they're useless,” Amado said. “When an alert does come out, it really simplifies it down to, ‘This is your problem, walk through these steps and here's how you remediate it.’”

Without a dedicated security team to help internally, Amado leans on Blumira’s 24/7 Security Operations team to help support them throughout incidents or answer questions that may come up. 

“It’s like having that extra person working for the city to help us with security. It makes it a pretty easy choice,” Amado said. “Automation is huge, especially with Blumira, that’s where a lot of the automation comes in place. It’s ingesting billions of logs over the past six months. We don't have a dedicated person to actually look through and make determinations on that. It'll save time. And in my opinion, I believe it focuses the resources your staff needs to implement to address these issues.”