| 5.7 |
Threat intelligence |
Integrates with STIX/TAXII-based threat feeds and utilizes a built-in threat intelligence platform to identify and alert on malicious IPs, URLs, and domains interacting with your network. |
| 5.15 |
Access control |
Monitors and audits logical access attempts across servers, databases, and applications. It generates alerts for unauthorized access attempts and tracks user logons and logoffs in real time. |
| 5.16 |
Identity management |
Audits the entire life cycle of user identities, including creation, modification, and deletion of accounts in Active Directory and cloud environments (Microsoft Entra ID, Microsoft 365). |
| 5.17 |
Authentication information |
Monitors password changes, resets, and account lockouts. |
| 5.18 |
Access rights |
Tracks changes to user permissions and group memberships. Provides detailed reports on which user changed what and when to identify privilege escalation or unauthorized rights assignment. |
| 5.24 |
Information security incident management |
Serves as the central console for incident detection. Its SOAR capabilities allow for automated workflows to contain threats immediately upon detection. |
| 5.28 |
Collection of evidence |
Ensures forensic readiness by securely archiving logs with cryptographic hashing to prevent tampering. Its powerful search engine allows for quick retrieval of historical data during investigations. |
| 5.33 |
Protection of records |
Automates the backup and retention of log data. It ensures logs are protected from unauthorized access, falsification, or deletion through granular access controls and integrity checks. |
| 8.1 |
User endpoint devices |
Monitors activities on endpoints, including file access, USB usage, and process executions. It audits local logons and logoffs as well as administrative actions on workstations. |
| 8.2 |
Privileged access rights |
Provides dedicated auditing for privileged accounts (e.g., Domain Admins). It uses UEBA to detect anomalous behavior that might indicate credential theft. |
| 8.3 |
Information access restriction |
Uses File Integrity Monitoring and file analysis to track access to sensitive files and folders, alerting on read, write, or delete actions by unauthorized users. |
| 8.7 |
Protection against malware |
Correlates logs from antivirus and IDS/IPS solutions with network traffic. It alerts on malware detection events and can trigger automated playbooks to isolate infected hosts. |
| 8.8 |
Management of technical vulnerabilities |
Integrates with vulnerability scanners to correlate known vulnerabilities with real-time log data, helping prioritize remediation based on active exploitation attempts. |
| 8.9 |
Configuration management |
Audits changes to system configurations, GPOs , and registry settings to ensure systems remain in a hardened, compliant state. |
| 8.10 |
Information deletion |
Allows you to define granular log retention policies. You can automate the secure deletion of logs after a specific period (e.g., 365 days) to comply with data minimization principles. It also audits manual file deletions across servers to ensure unauthorized data purging is not occurring. |
| 8.12 |
Data leak prevention |
Spots abnormal user behavior, such as unusual file or data accesses using UEBA. Sends notifications on various data exfiltration techniques, including the execution of malicious DNS and tunneling tools that extort and transmit data to Command and C ontrol servers. Blocks USB ports indefinitely upon detecting suspicious behavior. |
| 8.15 |
Logging |
Centrally collects and normalizes logs from 700+ sources (firewalls, servers, databases, cloud). It provides a comprehensive audit trail required for compliance audits. |
| 8.16 |
Monitoring activities |
Provides real-time security analytics and dashboards. It uses ML to establish behavior baselines and alerts on any deviations (anomalies) in system or user activity. |
| 8.20 |
Network security |
Analyzes logs from network perimeter devices (VPNs, Firewalls, IDS/IPS). It detects port scanning, lateral movement, and traffic from blocklisted regions. |
| 8.23 |
Web content filtering |
Identifies access to restricted or malicious websites by analyzing logs from proxy servers and web gateways. It helps enforce your organization's acceptable use policy and prevents Shadow IT risks. |
