Помогает командам безопасности обнаруживать, расследовать и отражать кибератаки и соответствовать требованиям: объединяет логи и телеметрию безопасности, применяет детекты и автоматизирует реагирование.
Auto-discovery and ingestion of Windows and syslog sources
Scheduled imports and agent-based collection
Gateway server for remote sites
Cloud sources including AWS, Azure, GCP, Salesforce and Microsoft 365
Категории: Log Management
Collect Windows and syslog event logs
Event correlation across sources
Reports with drill-down to raw logs
Категории: Log Management
Ingest logs from Windows, syslog, domain controllers, database servers and SQL/IIS servers
Категории: Log Management
Dashboards and 1000+ analytical widgets
Graphs and charts in reports
MITRE ATT&CK views
Категории: Log Management
Log-based monitoring of Active Directory, database and other servers
Alerts on repeated failed SUDO commands, abnormal SQL activity and unusual shutdowns or restarts
Категории: Log Management
750+ pre-built log parsers
Custom parser for human-readable logs with 20 auto-identified fields
Field Extraction UI for RegEx patterns
Категории: Log Management
Automatic archiving and encryption of logs, by default every seven days and customizable
Retention for SOX, GDPR and PCI DSS compliance
Категории: Log Management
Correlation rules and anomaly detection
Threat-intel, geolocation and user-identity enrichment
Predefined and custom reports and 30+ compliance templates
Категории: Log Analysis
1000+ analytical widgets and custom widgets
Graphs and charts in reports
MITRE ATT&CK visualizations
Категории: Log Analysis
Auto-discover Windows and syslog devices and ingest event logs
Track AD changes and firewall rule modifications in reports
Категории: Log Analysis
Automatic discovery of Windows and syslog sources
Scheduled imports from databases and vulnerability scanners
Agent-based collection and gateway server for remote sites
Cloud sources: AWS, Azure, GCP, Salesforce
Категории: Log Analysis
UEBA baselines per user and entity with peer grouping and risk scoring
ML adaptive thresholds
Detect abnormal logins, privilege misuse and impossible travel
Категории: Log Analysis
Real-time monitoring of Active Directory, databases, network devices, applications, endpoints and cloud platforms
Dashboards, security analytics consoles and alert profiles for suspicious events
Категории: Log Analysis
Search 25,000 logs per second with boolean, range and group options
Save searches as alert profiles or export as reports
Drill down to raw logs
Категории: Log Analysis
Real-time log collection, correlation and analysis
Built-in high availability for continuous monitoring
Категории: Log Analysis
Ingest and normalize feeds from 10+ sources and formats (STIX/TAXII, CSV, JSON, API) including Webroot, VirusTotal, AlienVault OTX and Constella
Enrich alerts with IP reputation, geolocation and IoCs
Score alerts as Critical, Trouble or Attention
Категории: Threat Intelligence
Visual SOAR playbooks with 50-60+ default templates
Block IPs, force password resets, revoke roles, isolate hosts
Restart machines, log off users, stop services, kill processes, run scripts via the ManageEngine agent
Every action logged with audit trail
Категории: Threat Intelligence
UEBA tracking of user and entity activity against baselines
Audit privileged user activity, file integrity and database changes with alerts
Категории: Threat Intelligence
Import vulnerability scanner data
Security and risk posture assessment for misconfigurations in Active Directory and MS SQL servers
Категории: Threat Intelligence
Monitor authentication logs, firewall events and network traffic
Check outbound communication against threat feeds and alert the SOC
Dark web monitoring for leaked credentials and personal data
Категории: Threat Intelligence
2000+ MITRE-mapped detections for ransomware indicators, APT stages, malicious URLs and worm-like activity
VirusTotal checks of files, URLs and domains
Категории: Threat Intelligence
Incident Workbench consolidates alerts, correlated events and risk context into one timeline
AI-generated user and incident timelines
Push incidents to ServiceNow or Jira
Категории: Threat Intelligence
Опыт пользователей с модерацией перед публикацией.
softosaur