Logsign

Security operations centers face two problems at once: too many logs to read and too many alerts to chase. Logsign, a Turkish company founded in 2010, builds a unified security operations platform that combines a next-generation SIEM, threat intelligence, user and entity behavior analytics and automated incident response. The company says it grew out of a conviction that cyber security is teamwork and that security products need to be smarter, and its site reports that more than 600 organizations use it.

SIEM and data collection

The SIEM is built to ingest data from any source, monitor it and visualize it. The vendor lists more than 400 built-in data collection integrations and offers a free plugin service, pairing this with an API-first approach so that tools from different vendors can be connected. More than 40 global threat intelligence feeds, along with internal threat data, enrich events in real time to help detect threats and attacks. The platform also supports compliance reporting for regulations.

User and entity behavior analytics

The UEBA module collects and analyzes data about assets and identities. It monitors who reaches critical data, flags risky users and watchlist users, and so adds a behavioral view to log-based detection.

Automation and response

Logsign SOAR automates and orchestrates detection and response. Repetitive tasks are automated so analysts can concentrate on decisions that need a person, and the vendor says automated, orchestrated response reduces mean time to respond and limits the impact of attacks. Integrations reach security and non-security devices alike, and workflows can run without interruption. End-to-end incident life cycle management is part of the offer.

Who it is for

The company aims the platform at medium and large firms and governmental agencies, and at managed security service providers wanting growth and profitability. It cites a scalable architecture and licensing options aimed at providers, and it publishes guidance on choosing a SIEM or a SOAR product, together with analyst reports on SOAR technology. Its materials mention 24/7 SOC services as well, and reviews can be read on Gartner Peer Insights.