Support
 
Support Get Quote
 
 
 
 

Real-Time Event Correlation

Discover complex attack patterns with correlation

Logs are the breadcrumbs of network activity and contain highly-detailed information about all user and system activity on your network. Basic log analysis helps you easily sort through millions of logs, and pick out the logs that indicate suspicious activity, as well as identify anomalous logs that don't align with normal network activity.

Real Time Event CorrelationOften, a single log viewed on its own may seem completely normal, but when viewed with a group of other related logs, could form a potential attack pattern. EventLog Analyzer's correlation engine discovers sequences of logs—coming from devices across your network—that indicate possible attacks, and quickly alerts you about the threat. It empowers you to go beyond just analyzing logs and start taking proactive steps against attacks.
  • Just ... days left! Are you ready for the GDPR
  • Get to know about the challenges and impacts of the all new GDPR
Learn more about how correlation works, along with sample use cases. Request our free guide today!

Log correlation with EventLog Analyzer

Log correlation with EventLog Analyzer

EventLog Analyzer's powerful correlation engine efficiently identifies defined attack patterns within your logs. Its correlation module offers many useful features, including:

  • Predefined rules: Utilize over 20 predefined attack patterns (or rules) that come packaged with the product.
  • Overview dashboard: Navigate the easy-to-use correlation dashboard, which provides detailed reports for each attack pattern as well as an overview report of all discovered attacks, facilitating in-depth analysis.
  • Timeline view: View a timeline diagram showing the chronological sequence of logs for every identified attack pattern.
  • Intuitive rule builder: Define new attack patterns with the easy-to-use rule builder, which provides a categorical list of network actions and allows you to drag and drop them into your desired order.
  • Field-based filters: Set constraints on log fields for fine-grained control over the defined attack patterns.
  • Instant alerts: Set up email or SMS notifications so you're immediately alerted whenever the system picks up a suspicious pattern.
  • Rule management: Enable, disable, remove, or edit rules and their notifications from a single page.
  • Column selector: Control the information shown in each report by selecting the columns needed and renaming them as required.
  • Scheduled reports: Set up schedules to generate and distribute the correlation reports you need.

Create rules with an intuitive interface

Create rules with an intuitive interface

With its rule builder interface, EventLog Analyzer makes the process of creating new attack patterns easy.

  • Define new attack patterns using over one hundred network actions.
  • Drag and drop rules to rearrange which actions comprise a pattern, and in what order.
  • Restrict certain log field values with filters.
  • Specify threshold values for triggering alerts, like how many times an action has to occur or the time frame between actions.
  • Add a name, category, and description for each rule.
  • Edit existing rules to fine-tune your alerts. If you notice a specific rule is generating too many false positives or fails to identify an attack, you can easily adjust the rule definition as needed.
Other features

SIEM

EventLog Analyzer offers log management, file integrity monitoring, and real-time event correlation capabilities in a single console that help meeting SIEM needs, combat security attacks, and prevent data breaches.

IT Compliance Management

Comply with the stringent requirements of regulatory mandates viz., PCI DSS, FISMA, HIPAA, and more with predefined reports & alerts. Customize existing reports or build new reports to meet internal security needs.

File Integrity Monitoring

Monitor critical changes to confidential files/folders with real-time alerts. Get detailed information such as 'who made the change, what was changed, when and from where' with predefined reports.

Log collection

Centrally collect log data from Windows servers or workstations, Linux/Unix servers, network devices viz., routers, switches, & firewalls, and applications using agent less or agent based methods.

Log analysis

Analyze log data from sources across the network. Detect anomalies, track critical security events, and monitor user behaviors with predefined reports, intuitive dashboards, and instant alerts.

Log forensic analysis

Perform in-depth forensic analysis to backtrack attacks and identify the root cause of incidents. Save search queries as alert profile to mitigate future threats.

Need Features? Tell Us
If you want to see additional features implemented in EventLog Analyzer, we would love to hear. Click here to continue

Customer Speaks
  • Credit Union of Denver has been using EventLog Analyzer for more than four years for our internal user activity monitoring. EventLog Analyzer provides great value as a network forensic tool and for regulatory due diligence. This product can rapidly be scaled to meet our dynamic business needs.
     
    Benjamin Shumaker
    Vice President of IT / ISO
    Credit Union of Denver
  • The best thing, I like about the application, is the well structured GUI and the automated reports. This is a great help for network engineers to monitor all the devices in a single dashboard. The canned reports are a clever piece of work.
     
    Joseph Graziano, MCSE CCA VCP
    Senior Network Engineer
    Citadel
  • EventLog Analyzer has been a good event log reporting and alerting solution for our information technology needs. It minimizes the amount of time we spent on filtering through event logs and provides almost near real-time notification of administratively defined alerts.
     
    Joseph E. Veretto
    Operations Review Specialist
    Office of Information System
    Florida Department of Transportation
  • I love the alerts feature of the product. We are able to send immediate alerts based on pretty much anything we can think of. We send alerts when certain accounts login, or when groups are changed, etc. That has been very helpful. Also the automatic archive of the log files has been very helpful and has taken the worry out of keeping old logs. The “Ask Me” function is very nice as well. It is great to have some natural language queries built in where you can just click a button and get an answer.
     
    Jim Earnshaw
    Senior Computer Specialist
    Department of Chemistry
    University of Washington
  • Windows Event logs and device Syslogs are a real time synopsis of what is happening on a computer or network. EventLog Analyzer is an economical, functional and easy-to-utilize tool that allows me to know what is going on in the network by pushing alerts and reports, both in real time and scheduled. It is a premium software Intrusion Detection System application.
     
    Jim Lloyd
    Information Systems Manager
    First Mountain Bank

EventLog Analyzer Trusted By

A Single Pane of Glass for Comprehensive Threat Management