Who needs a SIEM solution
SIEM is needed for any company that has a business and processes tied to computer infrastructure. You have many different network devices, workstations and servers, applications and various systems. You can control what happens separately on them and only when the staff enters the control console. But do not see the full picture of what is happening.
What does SIEM do
SIEM brings events from multiple devices into a single console, allows you to create litmus indicators and automatically notify about various threats: failures, unauthorized access attempts, viruses. And it really helps the business.
No budget? Are you planning?
Install the free version of RvSEIM free. It is possible to switch from a free version to a commercial one and back at any time without losing data!
Why our solution is right for you
We will help you from the beginning of the trial period to the implementation and refinement of our solution to your needs. The solution is quickly and easily customizable, adapts to your daily needs. Easy to use. We regularly provide free training for customers and partners.
No matter what data is fed to the input. It is possible to use any data from any sources. We help with connecting sources.
Looking for a solution for Standard compliance and regulatory compliance? You found it.
Our products
RuSIEM
RuSIEM is a commercial version of the SIEM (Security information and event management) class, which includes real-time correlation, data visualization and search, long-term storage of raw and normalized events, embedded incident management and reports.
RuSIEM Analytics
RuSIEM Analytics is a module for the commercial version that complements the AI (artificial intelligence), DL (data learning), asset management, and many other features to enhance the ability to detect various threats in a timely manner, solve many cases and visualize data.
RvSIEM free
RvSIEM free is LM (Log Management) class solution. It has reports, normalization, data search, long-term event storage, dashboards and visualization tools.
Let your data help you
IT system events will help to understand what is happening in your systems.
You will be able to control who, what and when changes, organize control over operators and privileged users.
Monitoring infrastructure in real time will help prevent failures, identify at an early stage and take action automatically.
What happens to your applications? Crash, errors, versions, their hashes.
Our solution is capable of collecting information both from the windows event log and at the network level, from third-party software.
The solution allows you to organize version control, application integrity analysis, and malware detection by SHA1, SHA256, MD5 file hashes.
Information security is important for any company, regardless of its size.
Events from the nodes of the infrastructure, combined into a single console, help to see the whole picture, allow not to miss the slightest details about what is happening.
Correlation rules are easily customized for any needs, help in real-time to respond to new threats.
Database auditing for critical systems helps to prevent data leaks and unauthorized access attempts.
Collecting audit trail logs and real-time processing helps prevent unauthorized access and alteration attempts, destructive actions, and data leaks.
Event processing not only with the help of advanced correlation rules, but also AI (artificial intelligence), DL (data learning) allows you to detect incidents that are not visible to the operator.
Events from IoT, SCADA, ACS can be used to assess stateful and threats.
Cyber-security threats to mission-critical industrial systems have taken a new level. Lacking any defense mechanisms, they became a vulnerable link with disastrous consequences.
Physical security devices may be useless if they do not work. Collecting events with ACS systems help to notify staff if errors are observed somewhere or devices have stopped working. The solution also prevents the risk of unloading audio and video recordings and deliberately stopping physical security systems.
WHY CHOOSE US?
Scale
The solution is developed with the latest technology and can be scaled to collect any amount of data.
Real-time correlation
Real-time correlation will help you respond to threats in a timely manner and prevent them using in-built scenarios.
Correlation Rules Flexibility
The graphic designer of correlation rules allows you to create advanced conditions and at the same time does not require knowledge of the code and special training.
Event normalization
Normalization allows you to select keys and values from events, prepare data for fast and accurate search, correlation, and precise mechanisms AI (artificial intelligence), DL (artificial intelligence).
AI, DL
AI (artificial intelligence) and DL (artificial intelligence) mechanisms help in detecting incidents and problems without having to write correlation rules for each case.
Low price
Despite the many functions in the product and the sufficient maturity of the solution, confirmed by many customers, the cost of our solution is lower than that of other solutions on the market.
Symptomatics
There is no need to remember the event text and event.id. Symptoms help you quickly find an event among millions of others. Operator-friendly symptoms names can be used in a search for events, reports, correlations.
Asset management
IT assets in RuSIEM Analytics are filled automatically from events, flow, network traffic data in real time. The asset template and its contents can be changed by the user.
Correlations
Real-time correlation provides prompt detection of threats and anomalies. A flexible and easy-to-use graphical designer of correlation rules ensures the creation of any user rules without knowledge of the code.
Incident management
Incident management ensures the interaction of teams and personnel in the operational solution of problems and incidents. Incidents visibility allows to maintain confidentiality. Inside the incident, you can assign tasks. Incident management is built according to the ITIL standard.
Long-term storage and search query
The solution stores both normalized and raw events over a long storage interval. Flexible event search allows you to search for events on any storage interval, to carry out both exact and regexp, partial search. Grouping, counting quantitative data, calculating averaged values, various visualization parameters will satisfy any needs.
Reports
The graphic designer allows you to customize any report format, change the location of the data in the report, logo, fonts, add and arrange graphic data. Running reports on a schedule and emailing selected recipients can be aware of what is happening.
Baseline and DL (data learning)
Baseline and DL (data learning) allow you to identify anomalies and threats without the need to create correlation rules for each case.
Vulnerability management
Vulnerability management provides vulnerability detection and timely notification of them. Vulnerability detection is performed over network traffic and based on events. Integration with Snort ensures the availability of data on open ports, services used and operating systems.
Authentification tracking
Authentication tracking allows you to create custom rules for any system and track user login parameters. If a user logged on in from another ip address or browser, an incident is created. In addition to ip and browser it is possible to specify other criteria.
Threat intelligence feeds
Threat intelligence feeds provide common threat detection patterns. The patterns are the ip address, md5, sha1 hashes, fqdn and url addresses that come regularly with updates. The user can create his own patterns and import his feeds.
Our partners
