Logz.io Cloud SIEM (Security Information and Event Management) aggregates security logs and alerts across distributed environments to allow teams to investigate security incidents from a single observability platform. The product combines OpenSearch Dashboards with security analytics tools to identify, investigate, and remediate threats. It includes 600+ pre-configured security rules to automatically highlight critical security events and 100+ pre-configured dashboards to visualize and investigate data. The platform automatically correlates data from user environments with multiple public threat feeds such as blocklist.de and alienvault reputation, supporting three IOC types: IP, DNS, and URL. The cloud-native architecture handles large and fluctuating data volumes without requiring maintenance to manage or upkeep the data infrastructure. It integrates with security services including firewalls, endpoint security, network security, identity management security, and container security. Cloud SIEM Event Management monitors triggered security events, assigns event handlers, and tracks the resolution process. Events can be configured to trigger alert notifications to endpoints like Microsoft Teams, Slack, and Gmail.
