CYBER DEFENSE OF URBAN DIGITAL SYSTEMS: SCALING SIEM CORRELATION TO REDUCE INCIDENTS IN A WARTIME CITY

Modern megacities are increasingly dependent on the resilience of digital platforms and converged networks that sustain critical urban life support systems. In the context of a full-scale war, where cyberattacks are strictly synchronized with the physical destruction of energy and communication infrastructure, ensuring the continuity of municipal services requires a fundamental shift from fragmented monitoring to centralized, intelligent incident management. This article systematizes the practical experience of designing, building, and operating a city-scale Security Operations Centre (SOC) based on the Specialized Municipal Enterprise “Kyivteleservis” during the period of 2021–2024. The object of the study is the complex protection processes of the Corporate Multiservice Network (CMN) of Kyiv, which connects over 1,800 municipal institutions, spans 1,500 km of fiber-optic communication lines, and supports the “Safe City” video surveillance system (comprising over 8,000 cameras) alongside the Internet of Things (LoRaWAN) sensor network. The author provides a detailed analysis of the operational challenges resulting from the sharp increase in cyber incidents and the shifting threat