Support
 
Support Get Quote
 
 
 
 

Threat Intelligence Solution

Enhance your threat intelligence platform

Stay ahead of cyberthreats

With the constant evolution of cyberattacks, it's become harder to prevent network intrusions. On top of that, abundant false alarms make real threats difficult to identify. In this ever-changing security landscape, sharing threat intelligence among organizations, as well as preventive and defensive strategies, has become vital in the fight against cyberattacks.

EventLog Analyzer's threat intelligence module is tailor-made for sharing threat intelligence through international threat feeds such as STIX, TAXII, and AlienVault OTX. With EventLog Analyzer, you can receive instant alerts through email and SMS when malicious IP sources interact with your network.

Detect attacks at the first sign of trouble by:

  • Correlating a global blacklist of Internet Protocols (IPs) with the IPs interacting with your network and triggering alerts when there is a match.
  • Using STIX, a structured language for cyberthreat intelligence solutions.
  • Using TAXII, a transport mechanism for sharing cyberthreat intelligence.
  • Using AlienVault OTX, the world’s most authoritative open-source threat information sharing and analysis network.

This way, you can quickly and efficiently prevent any compromise in your network security.

Guard against network intrusion

If your network is compromised, you may need to correlate multiple events across your network to confirm and analyze the attack; however, event correlation gives any potential intruder extra time in your network.

If you know an entity has acted suspiciously before (thanks to STIX, TAXII, and other sources of threat information), you can act as soon as they interact with your network to quickly mitigate the threat.

EventLog Analyzer widens the scope of malicious IP detection to include a global blacklist of IPs, creating a strong threat-intelligent solution that empowers you to quicky mitigate attacks. Reduce the fallout of a data breach using threat intelligence, a quick and reliable way to identify network intrusions.

EventLog Analyzer processes AlienVault OTX-based feeds and STIX/TAXII-based feeds to alert you in real time when globally blacklisted IPs and URLs interact with your network.

STIX

STIX provides a common language for describing cyberthreat information so it can be shared, stored, and otherwise used in a consistent manner that facilitates automation. STIX helps defend networks and systems against cyberthreats by giving cyberdefenders, cyberthreat analysts, malware analysts, security tool vendors, security researchers, and threat sharing communities access to standardized threat information.

TAXII

TAXII is a community effort to standardize the trusted, automated exchange of cyberthreat information. TAXII defines a set of services and message exchanges that, when implemented, enable organizations to share actionable cyberthreat information with one another.

AlienVault OTX

AlienVault OTX (Open Threat Exchange) is the world's largest crowd-sourced computer security platform. Altogether, over 26,000 participants in 140 countries share more than one million potential threats daily.

The OTX community reports on and receives threat data in the form of pulses. An OTX pulse consists of one or more indicators of compromise (IOCs) that constitute a threat or define a sequence of actions that could be used to carry out attacks on network devices and computers. OTX pulses also provide information on the reliability of threat information, who reported a threat, and other important details on threat investigations.

EventLog Analyzer's threat intelligence

In addition to the above threat feeds, EventLog Analyzer analyzes log data from threat intelligence applications to identify critical events such as malware attacks, source and target IPs, port scans, viruses, and active sensors. EventLog Analyzer provides out-of-the-box support for security solutions from popular vendors, including FireEye, Barracuda, WatchGuard, and Symantec.

Strengthened threat intelligence solution - EventLog Analyzer

  • Instantly identify over 600 million malicious IPs.
  • View a report of all generated alerts to gain deeper insight into your network, and export the report in PDF and CSV formats.
  • Use built-in alert profiles (no separate configurations required).
  • Stay up-to-date with dynamically-updated feeds.
 
 

Gartner MQ for SIEM is out Read the report to know about
the SIEM landscape

Customer Speaks
  • Credit Union of Denver has been using EventLog Analyzer for more than four years for our internal user activity monitoring. EventLog Analyzer provides great value as a network forensic tool and for regulatory due diligence. This product can rapidly be scaled to meet our dynamic business needs.
     
    Benjamin Shumaker
    Vice President of IT / ISO
    Credit Union of Denver
  • The best thing, I like about the application, is the well structured GUI and the automated reports. This is a great help for network engineers to monitor all the devices in a single dashboard. The canned reports are a clever piece of work.
     
    Joseph Graziano, MCSE CCA VCP
    Senior Network Engineer
    Citadel
  • EventLog Analyzer has been a good event log reporting and alerting solution for our information technology needs. It minimizes the amount of time we spent on filtering through event logs and provides almost near real-time notification of administratively defined alerts.
     
    Joseph E. Veretto
    Operations Review Specialist
    Office of Information System
    Florida Department of Transportation
  • I love the alerts feature of the product. We are able to send immediate alerts based on pretty much anything we can think of. We send alerts when certain accounts login, or when groups are changed, etc. That has been very helpful. Also the automatic archive of the log files has been very helpful and has taken the worry out of keeping old logs. The “Ask Me” function is very nice as well. It is great to have some natural language queries built in where you can just click a button and get an answer.
     
    Jim Earnshaw
    Senior Computer Specialist
    Department of Chemistry
    University of Washington
  • Windows Event logs and device Syslogs are a real time synopsis of what is happening on a computer or network. EventLog Analyzer is an economical, functional and easy-to-utilize tool that allows me to know what is going on in the network by pushing alerts and reports, both in real time and scheduled. It is a premium software Intrusion Detection System application.
     
    Jim Lloyd
    Information Systems Manager
    First Mountain Bank

EventLog Analyzer Trusted By

A Single Pane of Glass for Comprehensive Threat Management