ThreatDefence

The platform gathers extensive data sources using Syslog Data from a wide array of security tools, including firewalls, Email Security, DNS Security, and Endpoint Protection. This capability establishes a central authority for collecting and analyzing all log data across the client environment.

Advanced behavior analysis monitors access to privileged accounts and closely examines Entra ID Logons to set a behavioral baseline. Custom machine learning models continuously detect and uncover suspicious behavior that deviates from established normal activity.

ThreatDefence software utilizes Playbooks to define and enforce a consistent, automatic set of SOC Workflows upon detection. This automation applies to Security Detections for quick triage and escalation of incoming security Alerts, ensuring fast and organized incident handling.

The platform operates by deploying Physical and Virtual Sensor appliances across the network to monitor traffic at a granular level. These appliances retain weeks of valuable network evidence, supporting high speed threat hunting and post incident investigation.

A dedicated Endpoint Agent collects forensic telemetry directly from devices to enable highly detailed investigations and full incident recovery. The toolset facilitates the acquisition of evidence and allows for remote analysis across the entire enterprise.