Governance, detection, monitoring, vulnerability scanning and Secure DNS. One System
Six components built by one team to work as one. What the scanner finds, the Cyber Defence Center tracks. What the agent sees, the SIEM searches. What all of them do, your CISO can keep track on and the proofs are always available for the Auditor.
The hub and everything that reports to it
The Cyber Defence Center is where security is governed: what you own, what threatens it, what you decided, and what you can prove. The Eagle products are its senses, and Eagle SOC reaches every customer through one encrypted tunnel.
It integrates like no other, because it was designed as a whole
A suite assembled by acquisition is five databases, five sign-ins and five ideas of what an asset is, joined by connectors somebody has to maintain. This one was designed as a whole.
One security core
Every product signs in the same way, with an authenticator code and roles. Every product keeps an audit trail and a Security Log, and ships that log as syslog or CEF. Secrets are encrypted with AES-256-GCM and the databases support encryption at rest. Learn one product and you know how the others behave.
Agents that never take orders
Eagle SIEM, Eagle ScanV and Eagle MonV each have an agent of their own: one forwards logs, one answers for the machines a scan cannot reach, one reports health. Each asks its host a fixed list of questions and reports to its own product. There is no command channel, so an agent can never be made into a way in, and separate agents mean that one product's release or failure is never another's.
One door in each direction
A customer's SIEM stands behind Eagle SIEM Secure and dials out through an encrypted tunnel to Eagle SOC Secure, the one gateway in front of the SOC. No inbound port is opened at the customer, and one customer's tunnel cannot reach another's.
Findings become work
A vulnerability that Eagle ScanV confirms arrives in the Cyber Defence Center as a record with an owner, a due date set by its severity, and a place in the CMDB. When the next scan shows it fixed, the record closes. Nobody exports a spreadsheet.
An open door on every product
Each product has a documented REST API with an OpenAPI description and keys that are scoped to what they may do. The suite integrates with itself the same way it integrates with whatever you already run.
Yours, on your premises
Everything installs from an offline package onto your own servers. Log data stays with you. Licences are signed files, not a call home. No product embeds a borrowed scanning or monitoring engine, so there is no third-party licence waiting to surprise you.
Clusters that look after themselves
Updates roll through a cluster one node at a time, from signed releases, with a health check before the next node is touched. Hardening arms its own rollback before it is applied and stays only when the machine reports healthy afterwards. The changes that matter, a reboot, an upgrade, a deletion, need a second administrator.
As little as possible, as thorough as needed
Every component is built to the same test: does this take a step, a field or a dialogue away, or add one? A field is optional unless the record means nothing without it. The depth is there for the expert who wants it and never stands in the way of the person who does not. And the more components an organisation runs, the more the hub knows and can prove.
Made for the people who have to answer
ISO/IEC 27001:2022, NIS2, NIST CSF 2.0, NIST SP 800-53 and 800-171 and CIS Controls v8 are built in and mapped to each other, with DORA, GDPR by article, ISO 22301, ISO/IEC 27701, TISAX and SOC 2 as framework packs, and your own imported from a file. The CDC Score turns nine domains into one figure a board can follow, traceable to the records behind every point.
From the first packet to the board report
What you have
Eagle DNS Secure keeps the address plan and sees every name that is looked up. Eagle ScanV discovers what is actually on the network. Both answer the question every audit starts with.
What it is doing
Eagle MonV says whether it is up and healthy. Eagle SIEM says what happened on it, and whether that matches anything an attacker would do.
What to do about it
The Cyber Defence Center turns findings into risks, tickets and changes with owners and approvals, and records who accepted what.
That it was done
Evidence, audits and the management review live beside the records they are about. The board report is a button, not a week.
Complete GRC, ISMS, Security & IT Operations solution
The information security management system, the Service Desk and the security posture of the organisation, in one product and one database.
- Risk, assets and suppliers. Inherent and residual risk on your own matrix, numbered risks, a threat catalogue of your own, signed risk acceptance, and a CMDB with an impact view.
- Supplier assurance. A questionnaire goes to the supplier as a link that needs no account. The answers are scored, reviewed and signed off, and the next review is dated.
- Controls and frameworks. ISO/IEC 27001:2022 Annex A, NIS2, NIST CSF 2.0, NIST SP 800-53 and 800-171, and CIS Controls v8, mapped to each other so one piece of evidence answers several. DORA, GDPR by article, ISO 22301, ISO/IEC 27701, TISAX and SOC 2 come as framework packs, and national rules are imported the same way.
- NIS2 incident reporting. A significant incident carries the early warning at 24 hours, the notification at 72 hours and the final report a month later, as dated steps with reminders before each.
- Incidents, corrective actions and audits. From detection to closure, with the management review following clause 9.3.
- Service Desk. Tickets by mail, SLA targets, change requests and joiner, mover and leaver plans that need approval before they happen.
- Policies and knowledge. Document control with numbering and signed approval, and a versioned wiki that doubles as the knowledge base.
- CDC Score and board reports. One daily score from nine domains, and multi-page reports that export to editable PowerPoint.
- Evidence that collects itself. Microsoft Secure Score, Defender, Entra ID and Intune, Active Directory, VMware vCenter and Proxmox feed the registers.
- Nothing for an outsider. Until somebody has signed in, the product shows a sign-in page and not one word about what is behind it.
Always-on, scalable SIEM with secure communications, where the data stays with the customer
Eagle SIEM collects, stores and searches the logs of an organisation, in an instance of its own, on its own premises.
- KQL throughout. Search and detection use the query language your analysts already know.
- Sources that matter. Windows event logs and Sysmon, Linux journals, firewalls over syslog and CEF, Microsoft 365, Entra ID and Defender.
- Detections mapped to MITRE ATT&CK. Built-in rules for servers and for Microsoft 365 and Entra ID, each tagged with its tactic and technique.
- Threat intelligence. Open feeds plus TAXII 2.1, MISP and CrowdSec, matched continuously and hunted back through ninety days.
- Configuration assessment. Server and cloud posture rules mapped to NIS2, ISO 27001, NIST and ATT&CK.
- Isolated by design. One instance for each organisation, behind its own firewall, and the log data never leaves.
- A cluster, not a server. Intake, search and analysis scale as separate tiers, and nodes are added, drained and restarted from the SOC without touching the data. One node, three, or three and more.
- Three parts, one way in. The SIEM cluster holds and searches the logs. Eagle SIEM Secure is the firewall in front of it and the only way in or out. Eagle SIEM Front is the single point the SOC speaks to.
- Updates as one plan. Every node, the front host and the firewall are checked, prepared with a snapshot and a configuration backup, and upgraded one at a time, with a second administrator's approval.
- Hardened, with a way back. Hardening arms its own rollback before it applies and is kept only when the machine reports healthy.
- Secure communications. The instance dials out over an encrypted tunnel. No inbound port is opened at the customer.
The analyst portal, customer portal and orchestration platform
One place for the analysts who watch one organisation or many: every incident, every hunt, every handover.
- Incidents with clocks. Alerts grouped by entity, SLA timers, triage states, a timeline and suppression.
- Hunting that becomes detection. A library of hunting queries, and any query can become a rule after a backtest against the last seven days.
- Across every customer. One hunt, run over all the instances an operator looks after.
- On call, in the pocket. On-call rules by mail and push, and a mobile app for whoever holds the shift.
- The handover written down. What is open, what was decided, and what the next shift inherits.
- For the customer too. Branded weekly, monthly and yearly reports, and a portal where customers follow their own incidents.
- One question, every customer. When a vulnerability makes the news, the SOC asks the scanners which customers it touches and has the answer from their own data.
- Runs the estate. Every SIEM instance is managed from here: scaling, draining and enrolling nodes, each change approved by a second administrator.
The gateway in front of the SOC
Every customer's SIEM connects here, and nowhere else.
- One way in. A WireGuard hub where every customer's instance is a peer of its own, with keys and a network of its own.
- Customers kept apart. One customer's tunnel leads to the SOC and to nothing else.
- Dialled from the customer. The SOC never asks a customer to open a port to the internet.
- Seen from the portal. The state of the gateway and of every tunnel is shown in Eagle SOC.
The firewall in front of the SIEM
The way out to the SOC, and the way in for the OT Sensor. No inbound port is opened.
- One for every instance. Each customer's SIEM stands behind a firewall of its own.
- It dials out. An encrypted tunnel is opened from the customer to Eagle SOC Secure, and nothing is opened inbound.
- Logs in, over HTTPS and syslog. One address takes logs in with a certificate, and devices that only speak syslog are forwarded to the SIEM.
- Updates with a way back. Firmware updates are started from Eagle SOC after a configuration backup, and a savepoint restores the previous state if the firewall does not come back as it should.
Listens to the industrial network, and never transmits into it
A passive sensor for the networks that run a plant, reporting through Eagle SIEM Secure to Eagle SIEM.
- Passive by construction. It listens on a mirror port or a network tap, sends nothing into the OT network, and has no command channel.
- It speaks the plant's protocols. Modbus/TCP, DNP3, S7comm, EtherNet/IP and CIP, OPC UA, PROFINET, BACnet and more.
- An inventory and a baseline. What is on the network and who it talks to, learned by listening, and after fourteen days what is new stands out.
- Nothing lost when the line is down. Thirty days are kept on the sensor and forwarded when the connection returns.
Read-only agents, with no command channel
Small agents for servers and workstations, each with one job and a fixed list of questions.
- Logs, directly to Eagle SIEM. Windows event logs, Sysmon, PowerShell and Defender, and the Linux journal, over a pinned certificate.
- One job each. Eagle ScanV and Eagle MonV have agents of their own for the machines a scan or a login cannot reach. Agents are not shared between products.
- It answers. It does not obey. An agent never runs anything its server sends. A compromised server gets an inventory, never a shell.
- The least it can run as. A service account without administrator rights, a key for each host, and nothing written to the machine it reads.
Advanced System Monitoring
Hosts, services, network devices and applications, checked with or without an agent, and without a borrowed engine underneath.
- Availability. Ping, TCP, HTTP with response timing broken into its parts, DNS answers, and the TLS certificate with its chain and expiry.
- Server health, agentless. Windows over WinRM and Linux over SSH: processor, memory, disks, services, event log errors, pending restarts and backups.
- Read-only by contract. Collectors run a published, fixed list of commands and nothing else, and a test enforces it.
- Databases and web servers. SQL Server and MariaDB health, backups and jobs; HTTPS redirect and security headers.
- Alerts you can trust. Confirmation before a state changes, hysteresis on limits, flapping detection, and dependency chains so one failed switch is one problem, not forty.
- Network devices. Switches, routers and firewalls over SNMP v2c and v3: interfaces, traffic, errors, processor and memory. It reads, and never writes.
- Proxmox VE, the whole cluster. One check reads quorum, nodes, storage, the guests that must run, backups, replication and Ceph, through a read-only token.
- Disks over time. A history for every disk, its performance, and the number of days until it is full.
- Maintenance and objectives. Planned windows hold the noise, and quality targets say whether the service met what was promised.
Advanced Vulnerability Scanner
A network vulnerability scanner for one or many networks, with its own scanning engine and a finding you can defend in front of the system owner.
- Discovery that finds the quiet ones. Eight discovery methods, IPv6, and an asset identity that survives a change of address.
- Authenticated scanning. Linux over SSH against distribution advisories, Windows over WinRM against Microsoft's fixed builds, and network devices over SSH and SNMP.
- Every finding graded. Confirmed, likely or possible, each with its evidence, so the report is not a list of maybes.
- Priorities from the real world. CVSS, EPSS and the CISA known-exploited list order the remediation plan, with what is being exploited first.
- Safe by rule. Printers, controllers and medical devices get discovery only, and no probe is intrusive.
- Configuration audits. CIS Level 1 controls for Windows and Linux, where a failed control is a confirmed finding.
- It remembers. Every scan reconciles: fixed, reopened, accepted until a date, or a recorded false positive.
- Every CVE, answered. A catalogue of every known vulnerability, searched by number or in plain words, with what the authorities require, the fixed builds, and a plain answer on whether any of your hosts can be affected.
- An agent where a scan cannot reach. For laptops off the network and machines in a cloud: fixed questions, no command channel, and findings as confirmed as a credentialed scan.
Enterprise Secure DNS and IPAM System
A protective resolver, authoritative zones, DHCP and the address plan in one appliance, alone or clustered, managed from a web interface.
- Answers from the root. Recursion with DNSSEC validation on your own node, so no outside provider sees what your organisation looks up.
- Filtering with policy. Block lists, thirty categories, safe search, schedules per client group, and rules that say why a name was refused.
- Closes the side doors. Blocks resolver bypass over public encrypted DNS, protects against DNS rebinding, and rate-limits a client that misbehaves.
- Encrypted DNS. DNS over TLS and DNS over HTTPS for the clients that can use them.
- Zones under control. Primary, secondary and forward zones, split horizon per group, and two-person approval of changes.
- DHCP and IPAM. Scopes with failover, a subnet tree, the next free address on request, and discovery that reports what changed.
- High availability, measured. A signed configuration pulled by every member. When a node fails its address answers again within four seconds, and the other node loses nothing.
- Fast on small hardware. More than 48,000 cached answers a second on a node with two processors, with the full query log switched on.
- Updates without an outage. Signed releases rolled out from the web interface one node at a time: a two-node cluster in under a minute and a half, with no query lost.
- Hardened and watched. A host firewall built from the configuration, applied with an automatic rollback unless kept; health checks every minute; metrics for your own monitoring.
Built for the audit you actually have
See the suite running
An hour with the people who built it, on a real system, with your questions. No slideware.