Es hilft Sicherheits- und IT-Teams, die sonst eine komplexe lokale SIEM-Infrastruktur betreiben müssten, Log-Transparenz, Bedrohungserkennung, Vorfallreaktion und Compliance-Berichte für lokale und Cloud-Umgebungen (einschließlich AWS) aus der Cloud zu erhalten, mit skalierbarem Speicher und ohne Gebühren pro Ereignis.
Auto-updating threat intelligence from open-source and commercial feeds
Reputation-scored malicious IPs, URLs and domains via Advanced Threat Analytics add-on
Notifications when malicious sources interact with the environment
Kategorien: Cloud Security
Discover shadow IT applications
Track cloud app usage with application-wise and user-wise insights
Track unsanctioned app usage and ban applications
Kategorien: Cloud Security
Real-time security dashboards
Near real-time security event alerts
Agentless AWS CloudTrail, S3 and ELB log monitoring
Real-time Active Directory auditing
Shadow IT and cloud app usage tracking
Kategorien: Cloud Security
Mark and assign incidents to technicians and track resolution
Automatic assignment rules for critical issues
Forward incidents to ServiceDesk Plus, Zendesk and Kayako
Save Incident Workbench investigations as evidence
Kategorien: Cloud Security
Agent-based and agentless collection
700+ integrations across cloud, SaaS, servers, firewalls, databases and security tools
REST API connectors for custom applications
Log collection filter, log forwarding and import from external cloud storage
Kategorien: Log Management
Windows event log collection via agent
AWS, Azure, GCP and Microsoft 365 event normalization
AD logon and object change auditing with real-time alerts
Kategorien: Log Management
Windows event logs via agent
Linux/Unix syslog
Firewall, router, switch, VPN, DNS and DHCP logs
Database logs (SQL Server, Oracle, MySQL, PostgreSQL, IBM Db2)
Kategorien: Log Management
Interactive dashboards by severity, source and event category
Prebuilt security, compliance, AD and cloud security dashboards
Custom dashboards
Scheduled reports with CSV and PDF export
Kategorien: Log Management
Built-in parsers for 700+ integrations normalizing logs into a unified schema
Log enrichment with geolocation and threat intelligence matches
Custom log parser for custom application formats
Kategorien: Log Management
Hot Search Storage and cold Archival Storage
Tamper-proof log archiving
Reload archived logs for investigation
Up to 20 custom storage tiers with separate search and archival retention
Kategorien: Log Management
Auto-updated open-source and commercial threat feeds enriching log data
Advanced Threat Analytics add-on with reputation-scored IPs, URLs and domains
VirusTotal feed in the Incident Workbench
Kategorien: Threat Intelligence
60+ prebuilt SOAR playbooks
Drag-and-drop playbook builder with Python and Deluge scripting
Disable AD accounts, isolate endpoints, block IPs, execute scripts, disable USB
Integrations with ServiceDesk Plus, Zendesk, Jira, ServiceNow and webhooks
Kategorien: Threat Intelligence
User logon and logoff tracking with suspicious logon alerts
Changes to AD users, computers, groups, OUs and GPOs
Admin action monitoring for privilege abuse and lateral movement
UEBA user baselines
Kategorien: Threat Intelligence
Dark web monitoring for leaked credentials via Constella Intelligence
Alerts when malicious sources interact with the environment
User and AD activity monitoring
Kategorien: Threat Intelligence
ML-based UEBA baselines per user and entity built over 14-21 days with risk scoring on deviation
2,000+ prebuilt MITRE ATT&CK-mapped detection rules
Kategorien: Threat Intelligence
Kategorien: Log Management
Kategorien: Log Management
Erfahrungsberichte, vor der Veröffentlichung moderiert.
softosaur