It helps security and IT teams that would otherwise run complex on-premises SIEM infrastructure to get log visibility, threat detection, incident response and compliance reporting for on-premises and cloud (including AWS) environments from the cloud, with scalable storage and no per-event charges.
Auto-updating threat intelligence from open-source and commercial feeds
Reputation-scored malicious IPs, URLs and domains via Advanced Threat Analytics add-on
Notifications when malicious sources interact with the environment
Categories: Cloud Security
Discover shadow IT applications
Track cloud app usage with application-wise and user-wise insights
Track unsanctioned app usage and ban applications
Categories: Cloud Security
Real-time security dashboards
Near real-time security event alerts
Agentless AWS CloudTrail, S3 and ELB log monitoring
Real-time Active Directory auditing
Shadow IT and cloud app usage tracking
Categories: Cloud Security
Mark and assign incidents to technicians and track resolution
Automatic assignment rules for critical issues
Forward incidents to ServiceDesk Plus, Zendesk and Kayako
Save Incident Workbench investigations as evidence
Categories: Cloud Security
Agent-based and agentless collection
700+ integrations across cloud, SaaS, servers, firewalls, databases and security tools
REST API connectors for custom applications
Log collection filter, log forwarding and import from external cloud storage
Categories: Log Management
Windows event log collection via agent
AWS, Azure, GCP and Microsoft 365 event normalization
AD logon and object change auditing with real-time alerts
Categories: Log Management
Windows event logs via agent
Linux/Unix syslog
Firewall, router, switch, VPN, DNS and DHCP logs
Database logs (SQL Server, Oracle, MySQL, PostgreSQL, IBM Db2)
Categories: Log Management
Interactive dashboards by severity, source and event category
Prebuilt security, compliance, AD and cloud security dashboards
Custom dashboards
Scheduled reports with CSV and PDF export
Categories: Log Management
Built-in parsers for 700+ integrations normalizing logs into a unified schema
Log enrichment with geolocation and threat intelligence matches
Custom log parser for custom application formats
Categories: Log Management
Hot Search Storage and cold Archival Storage
Tamper-proof log archiving
Reload archived logs for investigation
Up to 20 custom storage tiers with separate search and archival retention
Categories: Log Management
Auto-updated open-source and commercial threat feeds enriching log data
Advanced Threat Analytics add-on with reputation-scored IPs, URLs and domains
VirusTotal feed in the Incident Workbench
Categories: Threat Intelligence
60+ prebuilt SOAR playbooks
Drag-and-drop playbook builder with Python and Deluge scripting
Disable AD accounts, isolate endpoints, block IPs, execute scripts, disable USB
Integrations with ServiceDesk Plus, Zendesk, Jira, ServiceNow and webhooks
Categories: Threat Intelligence
User logon and logoff tracking with suspicious logon alerts
Changes to AD users, computers, groups, OUs and GPOs
Admin action monitoring for privilege abuse and lateral movement
UEBA user baselines
Categories: Threat Intelligence
Dark web monitoring for leaked credentials via Constella Intelligence
Alerts when malicious sources interact with the environment
User and AD activity monitoring
Categories: Threat Intelligence
ML-based UEBA baselines per user and entity built over 14-21 days with risk scoring on deviation
2,000+ prebuilt MITRE ATT&CK-mapped detection rules
Categories: Threat Intelligence
Categories: Log Management
Categories: Log Management
User experiences, moderated before publication. Review policy
Be the first to share your experience with Log360 Cloud.
softosaur