Skip to main content

Cloud SIEM Highlights

Logz.io Cloud SIEM will help you detect threats and investigate security incidents as soon as you start sending logs. Here's how your Cloud SIEM will help you reduce mean-time-to-response and improve team productivity.

Get started in minutes​

Preconfigured security rules and monitoring dashboards make it simple to start identifying security incidents and attacks straight away.

The list of rules and dashboards is continuously expanding and Logz.io's dedicated team of security experts adds content and improvements on a regular basis.

You can configure your own notification settings and threshold triggers for any security rule to stay notified in real time of security incidents.

Follow structured workflows​

Structured workflows help you investigate events more systematically and methodically.

Begin with the Summary dashboard or with another relevant dashboard. Start by reviewing the summary lists of rules that have triggered. Click the Investigate button in any specific event to review the raw logs and get all of the relevant details surrounding it.

Then, continue your investigation using Drilldown links that take you directly from the most informative fields in logs to other relevant dashboards. Drilldown links help guide you through your next steps in the investigation so you can continue to expand your understanding of the event.

You can always add your own Drilldown links to fine tune your processes.

Direct your threat hunting efforts​

A dedicated Threat Intelligence dashboard will help you perform preemptive threat hunting more efficiently.

Cloud SIEM cross references incoming logs against industry-recommended threat feeds to identify malicious IPs, DNSs, and URLs. Logs are scanned for appearances of IOCs (Indicator of Compromise) and enriched when they are found.

Threats are tagged by their level of severity as indicated by the confidence of the source, to help reduce false-positives and to promote response to higher-risk threats.

Manage security events​

Monitor the triggered security events, assign event handlers, and track the resolution process in Cloud SIEM Event Management.

Create a shared Repository for security content​

Build a dedicated security library of the most useful dashboards, visualizations, saved searches, and private security feeds to share with all your Cloud SIEM accounts.

Learn more about creating your own SIEM Repository account in Manage the shared SIEM Repository.

Dedicated support from security experts​

Benefit from a smooth onboarding experience with Logz.io's security experts and get the customizations you request per your security products and environments.

Your first-class experience doesn't end there. Ongoing guidance and customer support will ensure the success and ROI of your implementation.

10 year retention of triggered rule logs​

Cloud SIEM logs a security event every time a rule triggers. The event log includes details of the security incident and the rule that caused it to trigger. These event logs are retained for 10 years.