Eagle SIEM Secure
The firewall in front of the SIEM: the way out to the SOC, and the way in for the OT Sensor. No inbound port is opened.
Eagle SIEM SecureAlways-on, scalable SIEM, where the data stays with the customer
Eagle SIEM collects, stores and searches the logs of an organisation, in an instance of its own, on its own premises.
What it does
Every log, searchable, with the detections already written
The language is the one your analysts already know, the tables are named as Microsoft Sentinel names them, and the data never leaves the building.
- KQL throughout. Search, hunting and detection rules are written in KQL, against tables that follow Microsoft Sentinel and ASIM. Queries and skills carry over.
- Sources that matter. Windows event logs, Sysmon, PowerShell and Defender logs, Linux journals, firewalls over syslog and CEF, Microsoft 365, Entra ID and Defender, from a catalogue of connectors.
- Detections mapped to MITRE ATT&CK. More than forty built-in rules for servers and for Microsoft 365 and Entra ID, each tagged with its tactic and technique.
- Threat intelligence. Open feeds plus TAXII 2.1, MISP and CrowdSec, matched every five minutes and hunted back through ninety days of logs.
- Configuration assessment. More than three hundred rules for Windows and Linux, checked every day and mapped to NIS2, ISO 27001, NIST and ATT&CK.
- Isolated by design. One instance for each organisation, behind its own firewall, and the log data never leaves.
- A cluster, not a server. Intake, search and analysis scale as separate tiers, and nodes are added, drained and restarted from the SOC without touching the data. One node, three, or three and more.
- Small on disk. Logs are stored in columns and compressed to about an eighth of their size.
- Updates as one plan. Every node, the front host and the firewall are checked, prepared with a snapshot and a configuration backup, and upgraded one at a time, with a second administrator's approval.
- Hardened, with a way back. Hardening arms its own rollback before it applies and is kept only when the machine reports healthy.
40+
Built-in detections, mapped to MITRE ATT&CK
5 min
Between threat intelligence matches
90 days
Hunted back when a new indicator arrives
8:1
Compression of the stored logs
In the suite
Three parts, one way in
The cluster holds and searches the logs. Eagle SIEM Secure is the firewall in front of it. Eagle SIEM Front is the single point the SOC speaks to.
Eagle Agents
Read-only agents on servers and workstations that forward their logs directly to Eagle SIEM.
Eagle AgentsEagle OT Sensor
Listens to the industrial network and reports what it sees, through Eagle SIEM Secure.
Eagle OT SensorEagle SOC
Where the analysts work what the SIEM detects, for one organisation or many.
Eagle SOC
Eagle SecOps Suite
One part of one system
Eagle SIEM is part of the Eagle SecOps Suite: governance, detection, monitoring, vulnerability scanning and secure DNS, built by one team to work as one.
See Eagle SIEM running
An hour with the people who built it, on a real system, with your questions. No slideware.