DNIF

SIEM products are often priced by data volume, which pushes organizations with very large datasets to log less than they would like. DNIF builds a cloud-native platform that combines SIEM, user behavior analytics and SOAR, and its HYPERCLOUD edition is aimed squarely at customers who find existing SIEM tools extremely expensive at scale. The vendor describes the product as a hyperscale SIEM able to ingest, enrich, store and correlate security data at petabyte scale.

Cost and retention

The vendor claims a 90 percent reduction in cost from new approaches to storing, retrieving and aggregating data, and says customers can double or even triple their logging capacity on an existing budget. Everything stays hot for 365 days, with no warm or cold storage tier, so analysts do not wait on archive restores or rehydration when hunting threats or doing forensic work on a reported indicator of compromise.

Finding campaigns instead of alerts

DNIF uses machine learning and graph analytics to reduce hundreds of alerts to a few threat campaigns, so analysts can retrace what an attacker did. Case management shows how a campaign progresses through the kill chain. A feature called CoDOTS is said to cut on-screen time for SOC teams by 68 percent. All threat content is mapped to the MITRE ATT&CK framework, which shows what the platform can and cannot detect.

Building analytics

Analysts can write detections in the product's own query language or assemble them in a point-and-click builder, and pipelines work much like Python Jupyter notebooks, chaining logic blocks into multi-stage detections. Fields can be parsed from raw events at run time and applied retrospectively. Out-of-the-box content detects outliers with no-code machine learning, and use case families are updated as threats change.

Integrations and trust

The platform has multi-tenancy and role-based access control, starts with prebuilt integrations and playbooks, and connects to security devices, operating systems, cloud workloads and applications, as well as streaming events from multiple cloud providers. DNIF says it aligns its controls with industry best practice and has them tested regularly by third-party auditors.