Hilft Sicherheitsteams, Cyberangriffe zu erkennen, zu untersuchen und darauf zu reagieren sowie Compliance zu erfüllen, indem Logs und Sicherheitstelemetrie konsolidiert, Erkennungen angewendet und Reaktionen automatisiert werden.
Auto-discovery and ingestion of Windows and syslog sources
Scheduled imports and agent-based collection
Gateway server for remote sites
Cloud sources including AWS, Azure, GCP, Salesforce and Microsoft 365
Kategorien: Log Management
Collect Windows and syslog event logs
Event correlation across sources
Reports with drill-down to raw logs
Kategorien: Log Management
Ingest logs from Windows, syslog, domain controllers, database servers and SQL/IIS servers
Kategorien: Log Management
Dashboards and 1000+ analytical widgets
Graphs and charts in reports
MITRE ATT&CK views
Kategorien: Log Management
Log-based monitoring of Active Directory, database and other servers
Alerts on repeated failed SUDO commands, abnormal SQL activity and unusual shutdowns or restarts
Kategorien: Log Management
750+ pre-built log parsers
Custom parser for human-readable logs with 20 auto-identified fields
Field Extraction UI for RegEx patterns
Kategorien: Log Management
Automatic archiving and encryption of logs, by default every seven days and customizable
Retention for SOX, GDPR and PCI DSS compliance
Kategorien: Log Management
Correlation rules and anomaly detection
Threat-intel, geolocation and user-identity enrichment
Predefined and custom reports and 30+ compliance templates
Kategorien: Log Analysis
1000+ analytical widgets and custom widgets
Graphs and charts in reports
MITRE ATT&CK visualizations
Kategorien: Log Analysis
Auto-discover Windows and syslog devices and ingest event logs
Track AD changes and firewall rule modifications in reports
Kategorien: Log Analysis
Automatic discovery of Windows and syslog sources
Scheduled imports from databases and vulnerability scanners
Agent-based collection and gateway server for remote sites
Cloud sources: AWS, Azure, GCP, Salesforce
Kategorien: Log Analysis
UEBA baselines per user and entity with peer grouping and risk scoring
ML adaptive thresholds
Detect abnormal logins, privilege misuse and impossible travel
Kategorien: Log Analysis
Real-time monitoring of Active Directory, databases, network devices, applications, endpoints and cloud platforms
Dashboards, security analytics consoles and alert profiles for suspicious events
Kategorien: Log Analysis
Search 25,000 logs per second with boolean, range and group options
Save searches as alert profiles or export as reports
Drill down to raw logs
Kategorien: Log Analysis
Real-time log collection, correlation and analysis
Built-in high availability for continuous monitoring
Kategorien: Log Analysis
Ingest and normalize feeds from 10+ sources and formats (STIX/TAXII, CSV, JSON, API) including Webroot, VirusTotal, AlienVault OTX and Constella
Enrich alerts with IP reputation, geolocation and IoCs
Score alerts as Critical, Trouble or Attention
Kategorien: Threat Intelligence
Visual SOAR playbooks with 50-60+ default templates
Block IPs, force password resets, revoke roles, isolate hosts
Restart machines, log off users, stop services, kill processes, run scripts via the ManageEngine agent
Every action logged with audit trail
Kategorien: Threat Intelligence
UEBA tracking of user and entity activity against baselines
Audit privileged user activity, file integrity and database changes with alerts
Kategorien: Threat Intelligence
Import vulnerability scanner data
Security and risk posture assessment for misconfigurations in Active Directory and MS SQL servers
Kategorien: Threat Intelligence
Monitor authentication logs, firewall events and network traffic
Check outbound communication against threat feeds and alert the SOC
Dark web monitoring for leaked credentials and personal data
Kategorien: Threat Intelligence
2000+ MITRE-mapped detections for ransomware indicators, APT stages, malicious URLs and worm-like activity
VirusTotal checks of files, URLs and domains
Kategorien: Threat Intelligence
Incident Workbench consolidates alerts, correlated events and risk context into one timeline
AI-generated user and incident timelines
Push incidents to ServiceNow or Jira
Kategorien: Threat Intelligence
Erfahrungsberichte, vor der Veröffentlichung moderiert.
softosaur