Innspark SIEM is a security information and event management platform that collects, correlates, and analyzes log and event data from across an organization's IT infrastructure to support threat detection, investigation, and response (TDIR).
The platform collects raw logs in real time from networking devices, security devices, operating systems, virtualization platforms, mainframes, databases, storage systems, hypervisors, and legacy systems. It supports multiple collection protocols and formats including TCP/UDP, syslog, OPSEC, WMI, SDEE, ODBC, JDBC, FTP, SCP, HTTP, text file, CSV, and XML.
It applies correlation rules, including out-of-the-box and custom-built rules, to consolidate high event-per-second volumes, reduce false positives, and map incidents for analysis. The system provides centralized, scalable storage (including SAN and NAS) with fast search across raw and enriched data, and can extend log retention and processing capacity as needed.
Innspark SIEM includes network monitoring for anomalous behavior and trend identification, proactive threat hunting mapped to MITRE ATT&CK and the Cyber Kill Chain, and forensic investigation capabilities for reconstructing and analyzing incidents. It integrates with an incident management system and supports threat intelligence enrichment via honeypots, TOR communication visibility, and regional/vendor threat intel feeds.
The platform also provides compliance reporting with pre-built and customizable report templates, automated retrieval of archived logs for analysis, and a centralized web interface supporting up to 100 concurrent sessions. Machine learning is used to improve detection accuracy and reduce noise in security event analysis.</description>
<parameter name="summary">SIEM platform for log collection, correlation, threat detection, and TDIR operations
Shares 4 capabilities with VRadar: Log Management, Network Monitoring, Anomaly Detection, Detection Rules
