Correlation engine, A.I. analysis, Hunt assistant, Investigation Mode, e-mail security, forensic bundles, webhooks, 5651 compliance — the full suite of enterprise SIEM. Easy installation, deep analysis, audit-ready reports.
Raw alarms are a nightmare. The same attacker gets caught in 20 different patterns in one day. Our Incident Builder intelligently clusters related alarmsto meaningful eventstransforms.
It is pointless to look at each log one by one. Correlation engine in firewall, mail and Windows traffic sees behavioral patterns — port scanning, SMTP brute, password spray, after-hours access and more.
MITRE ATT&CK is the world's standard framework for classifying cyber attacks. Which tactic and technique corresponds to each incident — automatically is tagged and goes into your report.
Supports out-of-the-box most common firewalls in the enterprise and SMB market. You can listen to any device that has syslog sending turned on — custom parsers with 99.9% parse success.
learned → approval from panel → promotion (e.g. pfSense slug)
Password alone is no longer enough. Google Authenticator, Microsoft Authenticator, Authy or 1Password — it all works. RFC 6238 standard.
One panel, multiple customers. Each customer sees their own data, you manage each one. Ideal for security service providers.
If the auditors want something — we are already ready. Log retention periods, hash signatures, user action logs, access controls — it's all standard.
The hardest part of SIEM: writing the right filter. Our A.I. assistant,you ask in natural languagequery sentence Converts it to a SIEM filter. Speech memory — remembers the previous question.
Probing an IP takes 10+ minutes in normal SIEM. Our Investigation Mode is one click away7 parallel queriesexecutes + A.I. produces verdict: allowlist? Does Intel have threat? Which tenants did it attack? geographical location?
critical for hosting and Windows mail servers: Plesk/Postfix,hMailServerand visually monitor MailEnable traffic. Banner sweep, SMTP brute force, account compromise indications — all automatically detected.outbound spamBe aware before you start.
| Sender | Domain | ||
|---|---|---|---|
| info@firma.example | → | @gmail.com | 247 |
| sales@firma.example | → | @outlook.com | 142 |
| admin@firma.example 🚨 | → | @unknown-domain.xyz | 1.2K |
When an incident is closed, it belongs to that event.all logs, alarms, timelinearchived in a single signed file. HMAC-SHA256 signature — if changed, it will be immediately obvious. It is presented as evidence when the court requests it.
When Auto-Mode is activated, the system changes depending on your device type.56 ready rule packautomatically installs. A.I. detects whether there is a false positive when the alarm is triggered. decides — filters out unnecessary notifications.
When a critical alarm is triggered — sends HTTP POST to any system you want. Let it go to the Slack/Teams channel, open a Jira ticket, send the order to the firewall API, trigger the backup.HMAC signed, including retry logic.
POST https://hooks.slack.com/... X-OxiSec-Signature: sha256=a8f3... Content-Type: application/json { "event": "alert.critical", "timestamp": "2026-05-09T08:30:00Z", "tenant_id": 11, "data": { "title": "SSH Brute Force", "severity": "critical", "source_ip": "203.0.113.45", "tenant_name": "Anadolu Energy" } }
Live alert banner with SSE, MITER heatmap, world map and customizable widgets on the main panel. Rule density statistics and closure with FP on the correlation page.
In SOC, the job is not over just because the incident is closed.casesThe module maintains SLA, assignment and audit trail.Asset TimelineCombines log, alarm and correlation for single IP or user.
Sigma YAML turns into OxiSec rule in seconds. Read alarms and run Hunt queries with REST API. The runbook catalog offers ready-made SOAR templates — step-by-step intervention flows that are different from the webhook.
alerts:read, hunt:query scoped switches (business+)title: SSH Brute Forcelogsource:product: linuxdetection: condition:selection→ OxiSec Connection Rule ✓
Not just logs — CPU, memory, port status from switches and routers. For MSSP and multi-branch structuresTenant Sitesand Frankfurt, Virginia and Istanbul are grouped separately; The attack map automatically reflects protected areas.
There is no separate syslog port. Unrecognized logslearnedIt accumulates in phase; Once approved from the panel, the rules become active. Once stable, it is promoted to official device type (e.g. pfsense).
1. Generic parse
2. A.I. tail (5+ log)
3. Kural learned
4. Panel approval + promotion
5. Appears in the device type list