One shared schema instead of a format zoo
Events are normalized onto OCSF and given an identity dimension. Only then can Windows event logs, Entra ID sign-ins and syslog messages be analysed together.
Security Operations
SIEM Integration
Turn security alerts into managed incidents
This integration does not aim to be a SIEM. It closes the gap behind one. Events arrive via syslog, webhook or API, are normalized onto the Open Cybersecurity Schema Framework and given an identity dimension so events from different sources become comparable at all. They are then enriched: asset and network assignment, country of origin, IP reputation and the mapping to MITRE ATT&CK. The reference data sits locally, with no cloud lookup per event. The result is not another dashboard but an incident inside the ISMS, with ownership and a path to resolution.
ISO 27001NIS2MITRE ATT&CKOCSF
Features
Your benefits
Enrichment from local data
Asset and network assignment, country of origin, IP reputation and MITRE ATT&CK mapping including a heatmap. The reference data sits offline in house, with no cloud lookup per event.
Correlation, not just forwarding
Dedicated correlation rules bundle related events into one incident. Individual high and critical events can alternatively just raise an alert without creating an incident.
AI triage stays your decision
An optional LLM triage estimates severity, category and recommendation. It is off by default, redacts the data beforehand through the de-identification layer and is cleanly skipped when no AI integration exists.
Capabilities
Capabilities in detail
- Reception via syslog, webhook and API
- Normalization onto the Open Cybersecurity Schema Framework (OCSF)
- Identity dimension on events and identity resolution
- Windows security event log via the agent, with an event catalog
- Entra ID sign-ins as a dedicated source
- Enrichment with asset and IT system assignment
- Enrichment with network assignment and IP visibility
- Country of origin and IP reputation from local reference data
- MITRE ATT&CK mapping including a heatmap
- Dedicated correlation rules with correlated incidents
- Automatic incident creation for critical events
- Alert path for individual high and critical events without an incident
- Optional LLM triage, off by default and redacted beforehand
- Correlated incidents fire rule chain triggers (SOAR light)
- Event export as CSV
- Vendor resolution via OUI and reverse DNS lookup
- File access events from the Windows log (4663, optionally 5145) as a dedicated source
- Microsoft 365 audit: the unified audit log for SharePoint Online and OneDrive
- Cloud-side encryption produces no Windows events; this source closes that gap
- Retrieved every fifteen minutes with paging, duplicate checks and throttling handling
- BullWall as an event source, with a tolerant parser for key-value syslog
- Recognises a third-party containment and sets the containment timestamp on the incident
- Such events attach to the most recent incident from the same source instead of creating a second one
Result
Detection and response are connected, and the alert does not end in a mailbox but as an incident with an owner.
Experience SIEM Integration live
Schedule a no-obligation demo – we will show you the module with your own use cases.