In today's evolving threat landscape, the key to efficient threat mitigation is early threat detection, and the key to this process is access to up-to-date, global threat information. However, organizations don't possess this kind of information in house. Structured Threat Information eXpression (STIX)/Trusted Automated eXchange of I ntelligence Information (TAXII) protocols emerged to fill this gap, providing globally applicable standards for identifying and sharing threat information.
One of the greatest strengths of EventLog Analyzer's threat i ntelligence platform is its support for STIX/TAXII protocols. EventLog Analyzer processes STIX/TAXII-based feeds to alert you in real time when globally blocklisted IPs and URLs interact with your network.
STIX
STIX provides a common language for describing cyberthreat information so it can be shared, stored, and otherwise used in a consistent manner that facilitates automation. STIX helps defend networks and systems against cyberthreats by giving cyber defenders, cyberthreat analysts, malware analysts, security tool vendors, security researchers, and threat sharing communities access to standardized threat information.
TAXII
TAXII is a community effort to standardize the trusted, automated exchange of cyberthreat information. TAXII defines a set of services and message exchanges that, when implemented, enable organizations to share actionable cyberthreat information with one another.
The formats of STIX/TAXII
EventLog Analyzer's threat i ntelligence platform supports two different formats of the STIX/TAXII protocol, namely, STIX 1/TAXII 1.0 and its successors, STIX 2/TAXII 2.0 and STIX 2.1/TAXII 2.1.
The first version of the STIX standard is referred to as STIX 1/TAXII 1.0. To represent and exchange threat i ntelligence data, STIX 1/TAXII 1.0 mainly uses extensible markup language (XML). However, STIX 1/TAXII 1.0 has certain limitations. STIX 1/TAXII 1.0 was difficult to work with and comprehend due to its verbose and complex data model. The data model was simplified using STIX 2/TAXII 2.0 and STIX 2.1/TAXII 2.1, which improved its usability and intuitiveness.
Considering these limitations and to meet the demands of organizations, EventLog Analyzer has expanded its support for STIX 2/TAXII 2.0 and STIX 2.1/TAXII 2.1 versions. They offer a more adaptable, interoperable, and contemporary architecture for representing and exchanging cybersecurity threat i ntelligence. JavaScript Object Notation (JSON) is the primary format used by these versions to represent threat i ntelligence data. Also, STIX 2 provides rich threat i ntelligence data through its structured and standardized data model, which allows for the representation and sharing of a wide range of information about cyberthreats.
EventLog Analyzer offers quick-deploy integration with the following vendors:
The threat i ntelligence feeds listed below come from reputable suppliers. They update their feeds frequently in order to offer better service over time. These feeds are filled with detailed threat i ntelligence information that may be used to understand attackers better, react to incidents more quickly, and anticipate a threat actor's next move. EventLog Analyzer is the best choice to swiftly deploy these services.
Other features
Collect and analyze Syslog data from routers, switches, firewalls, IDS/IPS, Linux/Unix servers, and more. Get in-depth reports for every security event. Receive real-time alerts for anomalies and breaches.
Analyze event log data to detect security events such as file/folder changes, registry changes, and more. Study DDoS, Flood, Syn, and Spoof attacks in detail with predefined reports.
Comply with the stringent requirements of regulatory mandates viz., PCI DSS, FISMA, HIPAA, and more with predefined reports & alerts. Customize existing reports or build new reports to meet internal security needs.
Monitor all types of log data from Active Directory infrastructure. Track failure incidents in real-time and build custom reports to monitor specific Active Directory events of your interest.
Monitor and track privileged user activities to meet PUMA requirements. Get out-of-the-box reports on critical activities such as logon failures, reason for logon failure, and more.
Monitor and audit print server with detailed reports on documents printed, attempts to print documents without proper permission, failed print jobs and their causes, and more.
Need Features? Tell Us
If you want to see additional features implemented in EventLog Analyzer, we would love to hear. Click here to continue
Free Edition
