Core
basic
The module is the central unit of the Search Anywhere Framework, orchestrating the interaction among its various components and providing a unified access point to their functionalities. It not only enables automated actions and notifications in response to search queries but also houses tools for constructing the Asset-Service-Model, granting users the capability to visually trace and represent causality relationships, such as degradation in service quality or specific IT/IS infrastructure malfunctions.
Incident Manager
basic
The module is a comprehensive solution dedicated to the life cycle management of incidents spanning areas of information security, IT infrastructure, abnormal user behaviors, and business process errors. Its primary role is to capture crucial events as incidents, streamlining the organization and offering tools to manage identified incidents.
Inventory
basic
IT operations
The module allows users to create a unified database of users and assets, including servers, workstations, network devices, information systems, and objects in a cluster infrastructure. It ensures that the asset database is kept up to date.
MITRE ATT&CK
cybersecurity
The module equips organizations to effectively deploy multiple MITRE ATT&CK use scenarios within their infrastructure. Users can evaluate their toolsets coverage of ATT&CK techniques, craft specialized threat models tailored to their IT landscape components, and detect potential technique use based on data source events.
Compliance
cybersecurity
business intelligence
The module revolutionizes regulatory conformance by automating and streamlining assessments through a Data-Driven approach. Moving beyond traditional methods, this module captures machine data from various sources, providing a holistic dashboard view of an organization's compliance. With continuous insights and an emphasis on objectivity, it transforms compliance from a task into a strategic advantage, enhancing both security and regulatory alignment.
Cyber Security
cybersecurity
The module enriches the Security Analytics Platform with curated content. It encompasses ready-made correlation rules, incident detection mechanisms, response playbooks, configurations to integrate any security tool with SAF, and pre-installed dashboards, all delivered in the form of periodic content updates.
Network
IT operations
The module is a robust tool for meticulous network monitoring and management. It auto-collects and analyzes equipment and communication data, allowing for swift issue detection and response. Resource tracking ensures optimal device performance and prevents inefficiencies, reducing maintenance costs.
Servers
IT operations
The module monitors and analyzes server processes, resource usage, including CPU, memory, and disk activity, aiding in optimizing resources and preventing inefficiencies. With S.M.A.R.T. protocol integration, the module preemptively detects potential hard drive issues.
Microsoft Active Directory
IT operations
The module controls of the main domain services, controls of user accounts: who is the domain administrator, who is the local administrator, notification when adding/removing an account from specific groups, determination of accounts that have not logged in for a certain period of time. Notification of the need to change passwords. Control of Active Directory security events.
Microsoft Exchange
IT operations
The module controls the operation of the main mail server services, allows analysis of email flow by recipients, senders, and detects spikes in activity. Auditing access to mailboxes, determining instances of mail forwarding, auto-replies, etc. Detection of anomalies in mail traffic.
NetMap
IT operations
The module streamlines network topology understanding by analyzing events from network devices to identify and categorize them, further detailing their connections, ports, and interfaces. It auto-discovers network topologies by leveraging MAC address tables, ARP tables, and the LLDP protocol, pinpointing vendors and hostnames of connected devices.
UBA
cybersecurity
business intelligence
IT operations
The module provides mechanisms for detecting deviations in the behavior of various types of objects: users, hosts, administrators, information systems, business processes, etc. The universal scoring mechanism allows for identifying potential intruders, compromised accounts, calculating a cybersecurity index, analyzing operational efficiency and labor discipline, and combating fraud.
Trading Antifraud
cybersecurity
business intelligence
The module is designed to detect and prevent corporate fraud in trading activities. The built-in mechanisms of the Trading Antifraud module enable profiling of employee activities and identification of high-risk transactions. The module operates using data enrichment mechanisms through integration with corporate information sources (ERP, CRM, etc.) and external information services (exchanges, information agencies).