Ajuda equipes de segurança e TI que de outra forma operariam uma infraestrutura SIEM local complexa a obter visibilidade de logs, detecção de ameaças, resposta a incidentes e relatórios de conformidade para ambientes locais e em nuvem (incluindo AWS) a partir da nuvem, com armazenamento escalável e sem cobrança por evento.
Auto-updating threat intelligence from open-source and commercial feeds
Reputation-scored malicious IPs, URLs and domains via Advanced Threat Analytics add-on
Notifications when malicious sources interact with the environment
Categorias: Cloud Security
Discover shadow IT applications
Track cloud app usage with application-wise and user-wise insights
Track unsanctioned app usage and ban applications
Categorias: Cloud Security
Real-time security dashboards
Near real-time security event alerts
Agentless AWS CloudTrail, S3 and ELB log monitoring
Real-time Active Directory auditing
Shadow IT and cloud app usage tracking
Categorias: Cloud Security
Mark and assign incidents to technicians and track resolution
Automatic assignment rules for critical issues
Forward incidents to ServiceDesk Plus, Zendesk and Kayako
Save Incident Workbench investigations as evidence
Categorias: Cloud Security
Agent-based and agentless collection
700+ integrations across cloud, SaaS, servers, firewalls, databases and security tools
REST API connectors for custom applications
Log collection filter, log forwarding and import from external cloud storage
Categorias: Log Management
Windows event log collection via agent
AWS, Azure, GCP and Microsoft 365 event normalization
AD logon and object change auditing with real-time alerts
Categorias: Log Management
Windows event logs via agent
Linux/Unix syslog
Firewall, router, switch, VPN, DNS and DHCP logs
Database logs (SQL Server, Oracle, MySQL, PostgreSQL, IBM Db2)
Categorias: Log Management
Interactive dashboards by severity, source and event category
Prebuilt security, compliance, AD and cloud security dashboards
Custom dashboards
Scheduled reports with CSV and PDF export
Categorias: Log Management
Built-in parsers for 700+ integrations normalizing logs into a unified schema
Log enrichment with geolocation and threat intelligence matches
Custom log parser for custom application formats
Categorias: Log Management
Hot Search Storage and cold Archival Storage
Tamper-proof log archiving
Reload archived logs for investigation
Up to 20 custom storage tiers with separate search and archival retention
Categorias: Log Management
Auto-updated open-source and commercial threat feeds enriching log data
Advanced Threat Analytics add-on with reputation-scored IPs, URLs and domains
VirusTotal feed in the Incident Workbench
Categorias: Threat Intelligence
60+ prebuilt SOAR playbooks
Drag-and-drop playbook builder with Python and Deluge scripting
Disable AD accounts, isolate endpoints, block IPs, execute scripts, disable USB
Integrations with ServiceDesk Plus, Zendesk, Jira, ServiceNow and webhooks
Categorias: Threat Intelligence
User logon and logoff tracking with suspicious logon alerts
Changes to AD users, computers, groups, OUs and GPOs
Admin action monitoring for privilege abuse and lateral movement
UEBA user baselines
Categorias: Threat Intelligence
Dark web monitoring for leaked credentials via Constella Intelligence
Alerts when malicious sources interact with the environment
User and AD activity monitoring
Categorias: Threat Intelligence
ML-based UEBA baselines per user and entity built over 14-21 days with risk scoring on deviation
2,000+ prebuilt MITRE ATT&CK-mapped detection rules
Categorias: Threat Intelligence
Categorias: Log Management
Categorias: Log Management
Experiências dos utilizadores, moderadas antes da publicação.
softosaur