DNIF

DNIF is a cloud-native security platform that merges SIEM, user behaviour analytics and SOAR in one product. Its HYPERCLOUD edition targets customers whose data volumes make conventional SIEM tools expensive to run.

What DNIF offers

• Large-scale ingestion — collects, enriches, stores and correlates security data at very high volumes.
• Threat campaign detection — uses machine learning and graph analytics to group many alerts into a few campaigns.
• Search and analytics — a native query language or a graphical query builder, plus pipelines for multi-stage use cases.
• ATT&CK mapping — threat content is aligned with the MITRE ATT&CK framework.
• Automation — prebuilt integrations and playbooks, with case management that tracks progress through the kill chain.

Who it works with

Security operations centres, including multi-tenant setups with role-based access control.

Key facts

• Data retention: all events stay immediately searchable for 365 days
• Integrations: cloud providers, security devices, operating systems and applications