Enhance your threat intelligence platform

Stay ahead of cyberthreats

With the constant evolution of cyberattacks, it's become harder to prevent network intrusions. On top of that, abundant false alarms make real threats difficult to identify. In this ever-changing security landscape, sharing threat intelligence among organizations, as well as preventive and defensive strategies, has become vital in the fight against cyberattacks.

EventLog Analyzer's threat intelligence module is tailor-made for sharing threat intelligence through international threat feeds such as STIX, TAXII, and AlienVault OTX. With EventLog Analyzer, you can receive instant alerts through email and SMS when malicious IP sources interact with your network.

Detect attacks at the first sign of trouble by:

• Correlating a global blacklist of Internet Protocols (IPs) with the IPs interacting with your network and triggering alerts when there is a match.
• Using STIX, a structured language for cyberthreat intelligence solutions.
• Using TAXII, a transport mechanism for sharing cyberthreat intelligence.
• Using AlienVault OTX, the world’s most authoritative open-source threat information sharing and analysis network.

This way, you can quickly and efficiently prevent any compromise in your network security.

Guard against network intrusion

If your network is compromised, you may need to correlate multiple events across your network to confirm and analyze the attack; however, event correlation gives any potential intruder extra time in your network.

If you know an entity has acted suspiciously before (thanks to STIX, TAXII, and other sources of threat information), you can act as soon as they interact with your network to quickly mitigate the threat.

EventLog Analyzer widens the scope of malicious IP detection to include a global blacklist of IPs, creating a strong threat-intelligent solution that empowers you to quicky mitigate attacks. Reduce the fallout of a data breach using threat intelligence, a quick and reliable way to identify network intrusions.

EventLog Analyzer processes AlienVault OTX-based feeds and STIX/TAXII-based feeds to alert you in real time when globally blacklisted IPs and URLs interact with your network.

STIX

STIX provides a common language for describing cyberthreat information so it can be shared, stored, and otherwise used in a consistent manner that facilitates automation. STIX helps defend networks and systems against cyberthreats by giving cyberdefenders, cyberthreat analysts, malware analysts, security tool vendors, security researchers, and threat sharing communities access to standardized threat information.

TAXII

TAXII is a community effort to standardize the trusted, automated exchange of cyberthreat information. TAXII defines a set of services and message exchanges that, when implemented, enable organizations to share actionable cyberthreat information with one another.

AlienVault OTX

AlienVault OTX (Open Threat Exchange) is the world's largest crowd-sourced computer security platform. Altogether, over 26,000 participants in 140 countries share more than one million potential threats daily.

The OTX community reports on and receives threat data in the form of pulses. An OTX pulse consists of one or more indicators of compromise (IOCs) that constitute a threat or define a sequence of actions that could be used to carry out attacks on network devices and computers. OTX pulses also provide information on the reliability of threat information, who reported a threat, and other important details on threat investigations.

EventLog Analyzer's threat intelligence

In addition to the above threat feeds, EventLog Analyzer analyzes log data from threat intelligence applications to identify critical events such as malware attacks, source and target IPs, port scans, viruses, and active sensors. EventLog Analyzer provides out-of-the-box support for security solutions from popular vendors, including FireEye, Barracuda, WatchGuard, and Symantec.

Strengthened threat intelligence solution - EventLog Analyzer

• Instantly identify over 600 million malicious IPs.
• View a report of all generated alerts to gain deeper insight into your network, and export the report in PDF and CSV formats.
• Use built-in alert profiles (no separate configurations required).
• Respond automatically to a threat using incident workflows.
• Stay up-to-date with dynamically-updated feeds.