SOCFORTRESS

Advanced Traffic Flow Analysis.

NIST CSF ID.AM-3: Organizational communication and data flows are mapped.

Show me more
Zeek integration.

NIST CSF DE.CM-1: The network is monitored to detect potential cybersecurity events.

Show me more

Advanced Traffic Flow Analysis for higher network visibilityZeek Logs and Events

SOCFortress integrates Zeek sensors and collects logs and connection events.

Traffic Analysis

All Zeek data and events is encrypted in transit, from your premises to our cloud endpoints.

Syslog Over SSL

Zeek events are processed, parsed and normalized. From JSON data to meaninful security events.

Normalization

From network connections to DNS requests, HTTP, SSL, file transfers... Multiple event sources.

The power of Zeek

Security feeds and threat intel applied to relevant metadata.

Signals & Indicators

Contact SOCFortress

Network Connections - Summary.

Each dashboard is composed of summaries and aggregated data for a quick overview of relevant events.

Connections to public IPv4 addresses are checkd against security feeds.

File Transfers - All supported Protocols.

All network activity related to files uploads/downloads.

Connections to public IPv4 addresses are checkd against security feeds.

File hashes are checkd against security feeds.

Detected software in network activity.

Transport Protocols and Detected Software.

Digital Certificates.

Client and Server certificates detected in SSL transactions.

Certificate Issuers, validity, expiring dates, etc.