Helps security teams detect, investigate and respond to cyberattacks and meet compliance by consolidating logs and security telemetry, applying detections and automating response.
Auto-discovery and ingestion of Windows and syslog sources
Scheduled imports and agent-based collection
Gateway server for remote sites
Cloud sources including AWS, Azure, GCP, Salesforce and Microsoft 365
Categories: Log Management
Collect Windows and syslog event logs
Event correlation across sources
Reports with drill-down to raw logs
Categories: Log Management
Ingest logs from Windows, syslog, domain controllers, database servers and SQL/IIS servers
Categories: Log Management
Dashboards and 1000+ analytical widgets
Graphs and charts in reports
MITRE ATT&CK views
Categories: Log Management
Log-based monitoring of Active Directory, database and other servers
Alerts on repeated failed SUDO commands, abnormal SQL activity and unusual shutdowns or restarts
Categories: Log Management
750+ pre-built log parsers
Custom parser for human-readable logs with 20 auto-identified fields
Field Extraction UI for RegEx patterns
Categories: Log Management
Automatic archiving and encryption of logs, by default every seven days and customizable
Retention for SOX, GDPR and PCI DSS compliance
Categories: Log Management
Correlation rules and anomaly detection
Threat-intel, geolocation and user-identity enrichment
Predefined and custom reports and 30+ compliance templates
Categories: Log Analysis
1000+ analytical widgets and custom widgets
Graphs and charts in reports
MITRE ATT&CK visualizations
Categories: Log Analysis
Auto-discover Windows and syslog devices and ingest event logs
Track AD changes and firewall rule modifications in reports
Categories: Log Analysis
Automatic discovery of Windows and syslog sources
Scheduled imports from databases and vulnerability scanners
Agent-based collection and gateway server for remote sites
Cloud sources: AWS, Azure, GCP, Salesforce
Categories: Log Analysis
UEBA baselines per user and entity with peer grouping and risk scoring
ML adaptive thresholds
Detect abnormal logins, privilege misuse and impossible travel
Categories: Log Analysis
Real-time monitoring of Active Directory, databases, network devices, applications, endpoints and cloud platforms
Dashboards, security analytics consoles and alert profiles for suspicious events
Categories: Log Analysis
Search 25,000 logs per second with boolean, range and group options
Save searches as alert profiles or export as reports
Drill down to raw logs
Categories: Log Analysis
Real-time log collection, correlation and analysis
Built-in high availability for continuous monitoring
Categories: Log Analysis
Ingest and normalize feeds from 10+ sources and formats (STIX/TAXII, CSV, JSON, API) including Webroot, VirusTotal, AlienVault OTX and Constella
Enrich alerts with IP reputation, geolocation and IoCs
Score alerts as Critical, Trouble or Attention
Categories: Threat Intelligence
Visual SOAR playbooks with 50-60+ default templates
Block IPs, force password resets, revoke roles, isolate hosts
Restart machines, log off users, stop services, kill processes, run scripts via the ManageEngine agent
Every action logged with audit trail
Categories: Threat Intelligence
UEBA tracking of user and entity activity against baselines
Audit privileged user activity, file integrity and database changes with alerts
Categories: Threat Intelligence
Import vulnerability scanner data
Security and risk posture assessment for misconfigurations in Active Directory and MS SQL servers
Categories: Threat Intelligence
Monitor authentication logs, firewall events and network traffic
Check outbound communication against threat feeds and alert the SOC
Dark web monitoring for leaked credentials and personal data
Categories: Threat Intelligence
2000+ MITRE-mapped detections for ransomware indicators, APT stages, malicious URLs and worm-like activity
VirusTotal checks of files, URLs and domains
Categories: Threat Intelligence
Incident Workbench consolidates alerts, correlated events and risk context into one timeline
AI-generated user and incident timelines
Push incidents to ServiceNow or Jira
Categories: Threat Intelligence
User experiences, moderated before publication. Review policy
Be the first to share your experience with ManageEngine Log360.
softosaur