SIEM
See what is happening across your devices, servers and Microsoft 365
Security events from the ResolveX agent, your firewalls and your cloud are collected in one place, searched in plain language and checked by detection rules mapped to MITRE ATT&CK.
What you get
SIEM in detail
Logs from the agent you already run
The ResolveX agent sends Windows security, system and PowerShell events, Sysmon and Defender events, and Linux authentication logs. There is no second agent to deploy.
Firewalls, servers and cloud
Receive syslog from network devices in common formats such as CEF and LEEF. Pull Microsoft 365 audit logs, Entra ID sign-ins and Defender alerts, and Acronis alerts, on a schedule.
Search in plain language
Type user:ahmed outcome:failure host:PC-01 and pick a time range. See a histogram, open an event to read the raw record, pivot to a device, user or address, and export to CSV.
Detection rules you can read
A built-in pack of curated rules covers brute force, password spray, new administrators, cleared logs, encoded PowerShell, ransomware behaviour and more. Import Sigma rules, clone a rule, tune it or switch it off.
MITRE ATT&CK and threat intelligence
Every rule is mapped to ATT&CK tactics and techniques, and a heat map shows where you have coverage. Events are matched against free public threat feeds, with an optional AlienVault OTX key.
File integrity monitoring and reports
Watch chosen folders for new, changed and deleted files. Reports show which controls of ISO 27001 Annex A, Saudi NCA ECC, UAE IA and PCI DSS logging requirements your evidence supports.
Compatibility
Logs it understands
Send syslog over UDP, TCP or TLS. If a source can send CEF, LEEF, key=value or JSON, it can be mapped.
- Windows Event Log
- Sysmon
- PowerShell
- Microsoft Defender
- Linux auth logs
- Microsoft 365 audit
- Entra ID sign-ins
- FortiGate
- Palo Alto
- Sophos
- Cisco ASA
- Acronis
Questions
Frequently asked
How much can it hold?
The standard setup is sized for about 500 endpoints and 30 days of searchable logs on one server. The storage layer is separate from the screens, so a larger store can be added later without changing how you work.
Do I need the SOC module too?
No. SIEM on its own gives you collection, search, detection and an alert queue. SOC and response adds incidents, playbooks and response actions on top.
Does it certify us against a standard?
No. Reports show which controls your recorded evidence supports for ISO 27001, Saudi NCA ECC, UAE IA and PCI DSS logging. They help an audit and are not a certification.
Where is the data kept?
On the ResolveX Pro server for your organisation, with your retention period. Credentials for cloud connectors are stored encrypted.