Помогает командам безопасности и ИТ, которым иначе пришлось бы эксплуатировать сложную локальную инфраструктуру SIEM, получать видимость журналов, обнаружение угроз, реагирование на инциденты и отчётность по соответствию для локальных и облачных сред (включая AWS) из облака, с масштабируемым хранилищем и без платы за событие.
Auto-updating threat intelligence from open-source and commercial feeds
Reputation-scored malicious IPs, URLs and domains via Advanced Threat Analytics add-on
Notifications when malicious sources interact with the environment
Категории: Cloud Security
Discover shadow IT applications
Track cloud app usage with application-wise and user-wise insights
Track unsanctioned app usage and ban applications
Категории: Cloud Security
Real-time security dashboards
Near real-time security event alerts
Agentless AWS CloudTrail, S3 and ELB log monitoring
Real-time Active Directory auditing
Shadow IT and cloud app usage tracking
Категории: Cloud Security
Mark and assign incidents to technicians and track resolution
Automatic assignment rules for critical issues
Forward incidents to ServiceDesk Plus, Zendesk and Kayako
Save Incident Workbench investigations as evidence
Категории: Cloud Security
Agent-based and agentless collection
700+ integrations across cloud, SaaS, servers, firewalls, databases and security tools
REST API connectors for custom applications
Log collection filter, log forwarding and import from external cloud storage
Категории: Log Management
Windows event log collection via agent
AWS, Azure, GCP and Microsoft 365 event normalization
AD logon and object change auditing with real-time alerts
Категории: Log Management
Windows event logs via agent
Linux/Unix syslog
Firewall, router, switch, VPN, DNS and DHCP logs
Database logs (SQL Server, Oracle, MySQL, PostgreSQL, IBM Db2)
Категории: Log Management
Interactive dashboards by severity, source and event category
Prebuilt security, compliance, AD and cloud security dashboards
Custom dashboards
Scheduled reports with CSV and PDF export
Категории: Log Management
Built-in parsers for 700+ integrations normalizing logs into a unified schema
Log enrichment with geolocation and threat intelligence matches
Custom log parser for custom application formats
Категории: Log Management
Hot Search Storage and cold Archival Storage
Tamper-proof log archiving
Reload archived logs for investigation
Up to 20 custom storage tiers with separate search and archival retention
Категории: Log Management
Auto-updated open-source and commercial threat feeds enriching log data
Advanced Threat Analytics add-on with reputation-scored IPs, URLs and domains
VirusTotal feed in the Incident Workbench
Категории: Threat Intelligence
60+ prebuilt SOAR playbooks
Drag-and-drop playbook builder with Python and Deluge scripting
Disable AD accounts, isolate endpoints, block IPs, execute scripts, disable USB
Integrations with ServiceDesk Plus, Zendesk, Jira, ServiceNow and webhooks
Категории: Threat Intelligence
User logon and logoff tracking with suspicious logon alerts
Changes to AD users, computers, groups, OUs and GPOs
Admin action monitoring for privilege abuse and lateral movement
UEBA user baselines
Категории: Threat Intelligence
Dark web monitoring for leaked credentials via Constella Intelligence
Alerts when malicious sources interact with the environment
User and AD activity monitoring
Категории: Threat Intelligence
ML-based UEBA baselines per user and entity built over 14-21 days with risk scoring on deviation
2,000+ prebuilt MITRE ATT&CK-mapped detection rules
Категории: Threat Intelligence
Категории: Log Management
Категории: Log Management
Опыт пользователей с модерацией перед публикацией.
softosaur