Modern Embedded Analytics platform for SIEM application

Modern Embedded Analytics platform for SIEM application

Overview

The company is one of the world’s largest enterprise software providers. Their vast range of solutions include analytics and big data management, application delivery management, IT operations management, log management, among others. Over the span of 45+ years, they have partnered with more than 40,000 businesses. They have helped the customers in their digital transformation journey successfully and serve 98 out of fortune 100 companies.

The organization was looking for a contemporary analytics platform that could become a part of their log management application’s process workflow. They wanted to integrate high-end analytics capabilities into their log management product.

Business Challenges and Requirements

Their log management product helps the customers to track, monitor and record logs from all their connected devices. It further helps the customers connect more than 400 varied data sources to assimilate security data. The company needed an analytics interface that could collate and process these logs and translate them into useful information. The company wanted to seamlessly integrate smart reporting and dashboarding capabilities into their product.

They were looking for a solution that would –

• Tightly couple with their application, with similar UI and customer experience
• Connect to their proprietary big database management system
• Smoothly process data from more than 400 data sources
• Enhance the querying process and provide dynamic query suggestions that would minimalize the efforts needed to query events and logs
• Provide pre-formatted, built-in reporting content, reports and dashboards for end users such as vulnerability overview reports, device monitoring dashboard, compliance, safety and accountability reports etc.
• Help in analyzing billions of events per day from across the organization
• Help the customers to monitor security logs and events in real-time
• Help in performing risk assessment
• Help to correlate issues from disparate data sources and bring out trends for timely assessment of upcoming threats
• Provide report formats and workflows that follow compliance and regulatory guidelines such as PCI, SOX, HIPAA
• Automate the complete reporting process so as no human intervention is needed, and the reports can reach to all recipients at a prescribed time
• Generate alert notifications whenever an anomaly occurs
• Follow the product’s user authentication and authorization workflow

Intellicus Solution

Intellicus is seamlessly embedded into the company’s application and become a part of their workflow. It has provided similar UI and user experience that has enabled faster user adoption amongst their customers. Intellicus seamlessly connects to their proprietary data source to provide high-volume, high performance reporting. It assimilates data that the application collects from various sources and builds a centralized reporting interface on top of it.

The application can store years of data. Intellicus simplifies the reporting process for this huge volume of data. Intellicus helps them to build pre-formatted built-in reporting content, reports and dashboards that quickens the report generation process and brings out critical information timely. These pre-built report formats follow compliance, data privacy, and regulation guidelines, thereby decreasing the time required to document for compliance.

Intellicus helps in analyzing billions of events per day and in bringing out useful information. The users can perform risk assessments, monitor logs and device security data in real-time, correlate historical data to detect possible threats and timely act on these inputs with the help of Intellicus reports and dashboards.

Intellicus has seamlessly embedded into the application’s security workflow. It manages the authentication and authorization mechanisms internally with utmost ease, without exposing any data or user information to the outside world.

The scheduler feature in Intellicus helps the organization to automate the complete reporting processes. With intellicus, users can create threshold points and generate alert notifications whenever an anomaly occurs.