SIEM

A failed logon looks the same whether it came from Windows, Linux or a VPN appliance: the same fields for who, from where and what happened. One search finds it everywhere.

• Fields named by what they mean, such as user, source address and process, not by the product that produced them
• The original message kept next to the normalized fields, for evidence and for anything the format does not cover

More than 5,000 detection rules from the security community and our own team, mapped to MITRE ATT&CK and ready on day one. Every environment is different, so every rule can be adjusted without being copied or rewritten.

• Turn off Switch off any rule for your account; its past alerts stay.
• Change the level Make a rule critical or low for your environment, without editing it.
• Add exceptions Silence a rule for a machine, account, address or path, with the reason kept.
• Write your own Upload rules in the common open YAML format; they are checked and live within seconds.

Brute force, password spraying and other patterns that only appear across many events.

• Many failed logons against one account, or one failed logon against many accounts
• A successful logon right after a series of failures from the same address

Connections and name lookups from your machines are compared with public lists of addresses and domains used by malware and attackers. A match raises an alert that names the list and the destination.

• Network connections and DNS lookups recorded on Windows, with the program that made them
• Program fingerprints compared with known malware at launch

Investigations need the raw history, not only the alerts. Every event can be searched by any field, over any period you keep, and the result exported for a report or another tool.

• Filters written as object and attribute, such as the user, the process or the source address
• The events before and after an alert on the same machine, opened from the alert