Vorpcel / Solutions / Protect endpoints
Auditors ask who accessed a server and when. An incident needs to know what happened on a machine three months ago. Vorpcel collects the logs of your machines and network devices, keeps them for the period you need and finds any event in one search.
At a glance
Each machine keeps its own logs for a few days, then overwrites them. An attacker who gets in can erase them. When the question comes, weeks later, the answer is gone. Central collection and retention turn logs into evidence.
Collecting is only half of it. The logs also need to be readable: the same event from different systems should look the same, so one search answers the question instead of ten.
Sign-ins and failed attempts on Windows, Linux and macOS, with the account and the source address, in one format.
Use of sudo on Linux and privileged actions on Windows, recorded with the user and the time.
Changes to the files and registry keys that matter, with who made them
Every program started, with its command line, its parent and its fingerprint
Firewalls, switches and appliances, by syslog to an agent you choose
Events stay searchable for the period in your contract, from a week to years, and older events move to low-cost storage instead of being deleted.
The same agent used for vulnerability management collects the logs of each machine. Network devices that cannot run an agent send their syslog to one machine you choose. Every event is put in one format, so one search covers all of them.
Turn on log collection per machine. The agent sends system and security logs, programs started and changes to important files, over an encrypted connection.
Events leave the machine shortly after they happen, so erasing the local logs does not erase the copy kept by Vorpcel.
Who signed in to a server, who changed a file, which program ran: search by any field over any period, and export the result as evidence.
More than 5,000 detection rules from the security community and our own team, mapped to MITRE ATT&CK and ready on day one. Every environment is different, so every rule can be adjusted without being copied or rewritten.
A failed logon looks the same whether it came from Windows, Linux or a VPN appliance: the same fields for who, from where and what happened. One search finds it everywhere.
Each alert channel chooses its events and minimum severity. Webhooks are signed, so your systems can trust them.
Most standards ask the same question: can you show what happened, and who did it?
| Standard | What it asks about logs |
|---|---|
| ISO/IEC 27001 | Logging and monitoring of activity on systems, with logs protected from tampering. |
| PCI DSS | Audit logs for access to systems that handle card data, kept for at least one year. |
| SOC 2 | Evidence that security events are recorded, reviewed and acted on. |
| LGPD | Records that help show who accessed personal data and support incident notification. |
Compliance depends on your own controls and on the scope agreed with your auditor. Vorpcel provides the logs and the search; it does not certify compliance.
No. Machines send their own logs through the agent. For devices that cannot run an agent, such as firewalls, you choose one machine with the agent to receive their syslog and forward it.
By the number of machines with log collection turned on. There is no charge per gigabyte, so a busy day does not change your bill.
Yes. Every event is stored and searched with the account it belongs to, and the agent sends it over an encrypted connection with its own credential.
If the agent is installed for vulnerability management, turning on the SIEM is one switch per machine.