Ayuda a los equipos de seguridad y TI que de otro modo gestionarían una infraestructura SIEM local compleja a obtener visibilidad de registros, detección de amenazas, respuesta a incidentes e informes de cumplimiento para entornos locales y en la nube (incluido AWS) desde la nube, con almacenamiento escalable y sin cargos por evento.
Auto-updating threat intelligence from open-source and commercial feeds
Reputation-scored malicious IPs, URLs and domains via Advanced Threat Analytics add-on
Notifications when malicious sources interact with the environment
Categorías: Cloud Security
Discover shadow IT applications
Track cloud app usage with application-wise and user-wise insights
Track unsanctioned app usage and ban applications
Categorías: Cloud Security
Real-time security dashboards
Near real-time security event alerts
Agentless AWS CloudTrail, S3 and ELB log monitoring
Real-time Active Directory auditing
Shadow IT and cloud app usage tracking
Categorías: Cloud Security
Mark and assign incidents to technicians and track resolution
Automatic assignment rules for critical issues
Forward incidents to ServiceDesk Plus, Zendesk and Kayako
Save Incident Workbench investigations as evidence
Categorías: Cloud Security
Agent-based and agentless collection
700+ integrations across cloud, SaaS, servers, firewalls, databases and security tools
REST API connectors for custom applications
Log collection filter, log forwarding and import from external cloud storage
Categorías: Log Management
Windows event log collection via agent
AWS, Azure, GCP and Microsoft 365 event normalization
AD logon and object change auditing with real-time alerts
Categorías: Log Management
Windows event logs via agent
Linux/Unix syslog
Firewall, router, switch, VPN, DNS and DHCP logs
Database logs (SQL Server, Oracle, MySQL, PostgreSQL, IBM Db2)
Categorías: Log Management
Interactive dashboards by severity, source and event category
Prebuilt security, compliance, AD and cloud security dashboards
Custom dashboards
Scheduled reports with CSV and PDF export
Categorías: Log Management
Built-in parsers for 700+ integrations normalizing logs into a unified schema
Log enrichment with geolocation and threat intelligence matches
Custom log parser for custom application formats
Categorías: Log Management
Hot Search Storage and cold Archival Storage
Tamper-proof log archiving
Reload archived logs for investigation
Up to 20 custom storage tiers with separate search and archival retention
Categorías: Log Management
Auto-updated open-source and commercial threat feeds enriching log data
Advanced Threat Analytics add-on with reputation-scored IPs, URLs and domains
VirusTotal feed in the Incident Workbench
Categorías: Threat Intelligence
60+ prebuilt SOAR playbooks
Drag-and-drop playbook builder with Python and Deluge scripting
Disable AD accounts, isolate endpoints, block IPs, execute scripts, disable USB
Integrations with ServiceDesk Plus, Zendesk, Jira, ServiceNow and webhooks
Categorías: Threat Intelligence
User logon and logoff tracking with suspicious logon alerts
Changes to AD users, computers, groups, OUs and GPOs
Admin action monitoring for privilege abuse and lateral movement
UEBA user baselines
Categorías: Threat Intelligence
Dark web monitoring for leaked credentials via Constella Intelligence
Alerts when malicious sources interact with the environment
User and AD activity monitoring
Categorías: Threat Intelligence
ML-based UEBA baselines per user and entity built over 14-21 days with risk scoring on deviation
2,000+ prebuilt MITRE ATT&CK-mapped detection rules
Categorías: Threat Intelligence
Categorías: Log Management
Categorías: Log Management
Experiencias de usuarios, moderadas antes de publicarse.
softosaur