Security

SIEM

The SIEM watches every log with detection rules and raises a signal when one matches.

Detection rules

Turn on rules from the library in Content Packs, or write your own. Every library rule comes with tests, and you can test your own rules on real logs before turning them on. Rules can be exported as Terraform to keep them in version control.

Historical jobs

Run a rule against logs from the past to see what it would have found, before you turn it on or after you learn about a new attack.

Threat intelligence

Logs are checked against threat feeds and your own indicator lists as they arrive. Use the IOC Explorer to look up an address, domain or file hash.

Suppressions

Silence known harmless activity, such as a scanner your team runs, without turning off the rule.

SOC

The SOC is where your team works the queue.

• Queue: every open signal and case, ranked by severity.
• Cases: related signals grouped into one piece of work with an owner and a timeline.
• Approvals: actions Emma has proposed that wait for a person.
• User Checks: questions sent to users, such as "Was this you?".
• Emma Investigation: what Emma found for each signal.
• SOC Metrics: how fast signals are handled and closed.

Cloud Security

Cloud Security scans your cloud accounts and shows:

• Misconfigurations: settings that break good practice, such as a public storage bucket.
• Vulnerabilities: known weaknesses in machines and images, ranked with live data on known exploits and the chance of attack.
• Identity risks: users and roles with more access than they use, and the attack paths that connect them to sensitive data.

You can write your own cloud rules in Rego. The Ownership Agent works out who owns each finding from tags, recent changes and history.

Code Security

Code Security scans your repositories for:

• Unsafe code, with static analysis rules you can extend
• Libraries with known vulnerabilities, with a full inventory and software bills of materials
• Secrets such as keys and passwords
• Mistakes in infrastructure-as-code

For many findings, Emma can write the fix and open a pull request for your developers to review.

Workload Protection

With the datagab agent on your Linux servers, Security also sees what happens on each host and can stop a process or isolate a host after a person approves. See the datagab agent.