Threat Detection + Security Information and Event Management (SIEM) Services

Actionable, not Noisy Alerts

The threat detection solution is built on a cloud native platform that aggregates and ingests log data from critical pieces of infrastructure, which uses machine data analytics and automated threat intelligence to provide contextualised security information and event management. The solution combines many of the leading and effective approaches into a single integrated highly accurate threat detection platform. This is achieved through:

• Our tailored onboarding process to identify key characteristics of normal, not-normal and abnormal/suspicious activity;
• Integration of multiple threat intelligence feeds, overlayed onto the client’s environment activity data;
• A large pattern database of past compromise techniques and event signals;
• Intelligent risk scoring of secondary attributes from third-party sources, such as obfuscation techniques, VPN endpoints, proxy avoidance sources, command and control sources, reputation databases, ISP and geographic databases;
• Machine learning of business-as-usual usage characteristics, including configurable standard deviation variation boundaries, time of day learning and risk scoring based on primary and secondary characteristics;
• Using ‘red-teaming’ and real-world compromise forensics to train the platform to detect actual threats and ignore false positives; and
• Custom-developed alerting and reporting systems to meet the needs of business and technical representatives, providing actionable rather than voluminous information.