Every industry has its own regulation. The need for log records is universal.
Collecting logs is not just a technical need; it is a legal obligation worldwide. Turkish Law 5651 and KVKK, GDPR and NIS2 in Europe, PCI DSS in finance and HIPAA in healthcare all mandate log collection. Not collecting your logs is not only a security gap but a serious legal risk.
Value in six areas
Security
Logs make cyberattacks, unauthorized access and suspicious activity visible. In a breach, logs are what you need to understand the source and impact of the incident.
Legal Compliance
Turkish Law 5651, KVKK, GDPR, NIS2, HIPAA, SOX, ISO 27001 and PCI DSS: many countries and industries have made log retention a legal requirement.
Incident Investigation & Forensics
Provides evidence-grade records when a security breach occurs; time-stamped logs can be used as formal evidence in court and in audits.
Operational Efficiency
System failures and performance issues are diagnosed quickly from logs; they act as an early-warning mechanism for IT teams.
Reporting and Traceability
User activity, access and changes can be reported; managers get a view of overall system health.
Cost Reduction
Attacks and issues detected early are resolved at a far lower cost; business interruptions and reputational damage are avoided.
Risk, regulation and solution for your industry
Government Agencies and Municipalities
E-government applications, citizen services and systems holding personal data require time-stamped logging and user-level reporting under Turkish Law 5651 and KVKK. Where logs are missing, liability falls directly on the authorized signatory (mayor, secretary general, etc.).
| Scenario | Regulation | Risk / Consequence |
|---|---|---|
| Criminal content was shared over the agency network; no access record could be found | 5651 | Liability falls on the authorized signatory |
| An employee accessed citizen data without authorization | KVKK | Fines and reputational damage |
| Personal data of EU citizens was leaked | GDPR | Heavy fines, reputational damage |
With Oriana
- Time-stamped archive of firewall, DNS and network access records with OrianaLOG, as required by Law 5651
- Central, user-level record of all system and user activity; incidents are identified quickly
- Access to personal data is monitored and protected in line with KVKK
- Insider threat and unauthorized access detected with UEBA in OrianaSIEM
- Data stays inside the organization; in-house R&D, manufacturer-direct support
Finance and Banking
Payment systems, customer account data and card transactions require detailed access logging and long-term retention under KVKK, the BDDK (Turkish banking regulator) Information Systems Regulation, PCI DSS and GDPR. With DORA, digital operational resilience and incident response processes also come under audit scope.
| Scenario | Regulation | Risk / Consequence |
|---|---|---|
| A bank employee accessed customer account data without authorization | KVKK · BDDK | Fines and reputational damage |
| Credit card transactions were not adequately logged | PCI DSS | International standard violation, risk of penalties |
| Data of EU customers was leaked | GDPR | Heavy fines |
With Oriana
- UEBA in OrianaSIEM: unauthorized data access and insider threat detection
- Reporting support for PCI DSS Requirement 10 and BDDK
- Predictable performance at high EPS; hot/archive retention plan of up to 2 years
- Data sovereignty: logs stay on-premises, no cloud egress cost
- Replica set / sharded cluster topology for high availability
Healthcare
Electronic health record (EHR) systems, appointment and laboratory applications hold special categories of personal data. KVKK, GDPR and HIPAA in the US require a record of who accessed patient data, when and how.
| Scenario | Regulation | Risk / Consequence |
|---|---|---|
| Staff accessed patients' medical records without permission | KVKK | Severe fines and reputational damage |
| The electronic health record system was not adequately logged | HIPAA | Heavy fines |
| Data of EU patients was leaked | GDPR | Heavy fines, reputational damage |
With Oriana
- Central, time-stamped collection of EHR, database and application logs
- File Audit tracks access, copying and permission changes on patient files
- UEBA detects anomalous patient record access outside working hours or at unusual volumes
- Time-stamped archive and audit-ready reports with OrianaLOG under Turkish laws 5651 and 5070
Retail
Loyalty program applications, POS and payment systems hold both customer personal data and card data. Across an infrastructure spread over hundreds of stores, missing logs make it impossible to trace the source of an incident.
| Scenario | Regulation | Risk / Consequence |
|---|---|---|
| An employee accessed customers' personal data through the loyalty program without permission | KVKK | Fines and reputational damage |
| Store POS and payment systems were not adequately logged | PCI DSS | International standard violation |
| Data of EU customers was leaked | GDPR | Heavy fines |
With Oriana
- Time-stamped, Law 5651-compliant archive of store firewall and network logs with OrianaLOG
- Central collection of POS, payment and loyalty application logs; PCI DSS reporting support
- Hundreds of stores monitored from a single console; service via partners under the MSSP model
- Low resource consumption keeps cost predictable across a large store footprint
E-Commerce
Membership, payment and order systems are under attack 24/7. When an employee or attacker gains unauthorized access to customer accounts, credit card and personal data can leak; with insufficient logs the source of the incident cannot be identified.
| Scenario | Regulation | Risk / Consequence |
|---|---|---|
| An employee or attacker accessed customer accounts without authorization | KVKK | Fines and reputational damage |
| Payment and card transactions were not adequately logged | PCI DSS | International standard violation |
| Data of EU customers was leaked | GDPR | Heavy fines |
With Oriana
- Correlation of web server (IIS/Nginx/Apache), WAF, database and application logs
- Brute force, credential stuffing and DDoS detection; USOM/CTI IoC matching
- Cookie consent logging: time-stamped record of Accept / Reject / Change choices
- Cloud or on-premises; capacity that grows automatically under peak load
MSSP, ISP and CSP Partners
When a small or mid-sized customer buys a SIEM on its own, it pays for the server, disk, installation, maintenance, staff and license alone; most give up on SIEM for that reason. In the MSSP model, service is delivered to multiple customers on shared servers and the infrastructure cost is split across them.
- Each customer's data, rules, alerts and reports are separate; customers never see each other
- All customers from a single console; a new customer is onboarded within hours
- Update once, apply to everyone; installation and capacity handled by Oriana
With Oriana
- Multi-tenant architecture; isolated data and reports per tenant
- Role-based access: device assignment per MSSP user, control at page/button/action level
- In the Oriana cloud or in the partner's own data center
- Separate dashboard, report and alert policy per tenant
Education and Campus
On university and school campuses, thousands of students and staff share the same network. Access records must be kept under Turkish Law 5651, student information systems holding personal data must comply with KVKK, and high-volume network traffic must be logged.
With Oriana
- Time-stamped archive of campus network, firewall and access point logs with OrianaLOG, as required by Law 5651
- Switch, access point and firewall logs collected at high EPS with low resource usage
- Student information system and database access monitored with OrianaSIEM UEBA
- Academic collaboration and training material support
Real problems solved in the field
10 failed logins in 5 minutes followed by a successful session; alert via event chain correlation.
VPN login → RDP to a critical server → privilege escalation; event chain tagged with MITRE ATT&CK tactics.
UEBA profiling flags access outside working hours, at unusual volumes or to systems never accessed before.
File- and content-based threat indicators detected with YARA and Sigma rules.
When the backup log expected every night at 02:00 does not arrive, exception-based correlation raises an alert.
User-level, real-time monitoring of read, copy, delete and permission changes on critical files and folders.
Legally admissible record of website visitors' Accept / Reject / Change choices.
Scheduled report generation and e-mail distribution for Law 5651, KVKK, ISO 27001 and PCI DSS audits.
Run in parallel with the existing SIEM; move sources in stages and measure side by side.
Let's plan a POC around a scenario from your industry.
Measurable results in 1-2 weeks, based on your regulatory needs, log volume and existing resources.