_2013-11-24_16-00.png?width=1024&height=293&name=1024px-Tibco_logo-_Palo_Alto%2c_CA_company-_(PNG)_2013-11-24_16-00.png){kind=logo}
Cloud Software Group grows by acquisition. Every new company brings its own tools, its own logs, and its own blind spots, and the security team has to absorb all of it without slowing the business down.
Rising Splunk costs, SOC turnover, and inconsistent processes were slowing every acquisition. Netenrich's first job was the foundation. In 12 weeks and three phases (data engineering, detection engineering, and response engineering), we moved CSG's entire security operation, across every subsidiary, off Splunk and XSOAR. We built custom parsers on a unified data model, grew log sources from 24 to 40 at more than 2 TB a day, and replaced 234 Splunk queries with 26 behavior-based detections covering 99% of critical alerts. More than 40 playbooks became three agent-executed workflows. Security costs fell by more than half.
But a modern SOC is never finished. CSG's security leaders were now facing risks that hadn't existed a year earlier. Developers had adopted AI coding tools, and some of them were pasting secrets straight into prompts. The new CitrixFlex tenant, which runs customer onboarding and the control plane, was in production before MDR coverage was in place. And the SOAR playbooks still couldn't sync with Jira in both directions.
See it: Netenrich enhanced the Anthropic and Claude Code parsers and built AI dashboards that make invisible risk visible, showing which tools are sanctioned, which aren't, and where plain-text secrets appear in prompts. Prove it: we brought CitrixFlex live under 24/7 MDR, with custom anomaly detections over Azure service principals and control plane activity, moving coverage from assumed to Provable Readiness. Run it: we reworked and modernized the playbooks and connected them to Jira in both directions.
That is the Netenrich model at work. ACT keeps invisible risk visible and readiness provable. Agentic SOC handles the response at machine speed. Together they add up to Autonomous Security Operations: a SOC that adapts as fast as the business does, so CSG's security leaders can spend their time on what comes next instead of what just broke.