Detects the important threats
Our experts’ know-how for pinpointing the latest threats is regularly encapsulated in expertise packs available from PT Knowledge Base.
MaxPatrol SIEM "gets smarter" all the time with PT Knowledge Base, which helps users to detect attacker TTPs before serious consequences happen.
Reduces the burden on in-house expertsExpertise packs are based on constant monitoring of new threats, analysis of attacks, and incident investigations. This reduces the burden on in-house security experts in charge of monitoring threats and writing rules. Rules included in expertise packs do not require painstaking adjustment and are ready to use after simple configuration.
Gives 360º visibility into infrastructureIT infrastructure becomes transparent to security staff: with inventory technology from the MaxPatrol vulnerability and compliance management system, MaxPatrol SIEM fully enumerates assets and security gaps. Data is collected actively and passively from over 300 types of systems.
Detection of malicious activity in traffic
MaxPatrol NAD Sensor provides full network visibility. This component analyzes network traffic in depth, passively collects data about assets, and detects attacks. The component notifies in real time about attackers’ attempts to expand their presence in infrastructure, steal data, exploit vulnerabilities, use hacker tools, or contact C2 servers.
The Positive Technologies Expert Security Center and R&D team monitor and perform research into new threats. Their know-how is regularly made available in expertise packs from PT Knowledge Base. Expertise packs contain new rules, updated parameters for collection and incident handling, response recommendations, and reputation lists. Packs are automatically provided to MaxPatrol SIEM in order to detect threats before serious consequences arise.
Correlation rules (included in expertise packs) can be easily customized to fit infrastructure. We provide detailed instructions and whitelists, which are prepopulated based on experience with real infrastructures.
Stay on top of changes in infrastructure
MaxPatrol SIEM accurately identifies IT assets even in a shifting landscape. Asset groupings adapt to the latest network changes. With these abilities, it’s easy to configure correlation rules for keeping an eye on systems that have non-updated software or particular vulnerabilities.
Regularly updated for better threat detectionEvery two months, MaxPatrol SIEM is updated with expertise packs containing new correlation rules, indicators of compromise, and playbooks.
Fast developmentWith two releases a year, we regularly introduce new technologies and constantly expand our product development team.
Lowers the threshold for entering into a SIEM worldWith each release of MaxPatrol SIEM, we boost efficiency for experts—and reduce the barrier to SIEM entry for novices.
Add event sources for free
During deployment, we connect business systems to MaxPatrol SIEM free of charge—even business systems that are esoteric or custom-developed.
Get in touch
will contact you shortly