MaxPatrol SIEM All-in-One provides full visibility into small to mid-sized IT infrastructures and detects security incidents. Get a full-featured SIEM system that works, even on a smaller budget.
Overview
Age controls for asset data. Unlimited incident storage. More performance tools. The new version of MaxPatrol SIEM offers plenty of reasons to upgrade.
Learn moreFor companies with small but important infrastructures
If your IT infrastructure stores sensitive data and a hack could harm your company's reputation, bottom line, or operations, it's time to build a security system that works. MaxPatrol SIEM All-in-One helps to spot hacking activity inside your network before it's too late and facilitates investigation.
Comparison: All-in-One vs. MaxPatrol SIEM
| MaxPatrol SIEM All-in-One | MaxPatrol SIEM | |
|---|---|---|
| Architecture | Simplified: no components for deep traffic analysis, malware scanning of files and emails, or analytics to assess overall security across distributed infrastructures | Customized to client needs, infrastructure size, and events per second (EPS) threshold |
| Form factors | Hardware appliance only (software running on Dell hardware) | Hardware appliance or software (deployable on client's physical server or virtual machine) |
| Scalability | License available for up to 1,000 hosts. One data collection agent per license. | Unlimited scalability. Multiple installations can be arranged hierarchically. |
Architecture
The core components of MaxPatrol SIEM All-in-One are deployed on a single hardware server provided together with the software. Two components, PT Retro Correlator (for retrospective analysis) and PT Update and Configuration Service (for online updates), require additional virtual or hardware servers.
1. MaxPatrol Core
Management server
2. MaxPatrol SIEM Server
Processes security events. Performs event aggregation, filtering, normalization, and correlation. Automatically creates incidents. Relates events to information assets.
3. MaxPatrol SIEM Events Storage
Stores security events in a central location. Includes Elasticsearch 7.4.2.
4. MaxPatrol SIEM Agent
Performs black-box and white-box scanning of assets. Collects events.
5. PT Knowledge Base
Provides expertise packs, macros, and normalization rules, as well as information about security bulletins and software on assets.
6. PT Update and Configuration Service
Ongoing updates of MaxPatrol SIEM components: checks for, downloads, and installs new component versions. Updates expertise packs, macros, normalization rules, and vulnerability databases.
7. PT Retro Correlator
Rechecks previously received events using the correlation rules.
Component diagram
In our report, learn what clients expect to accomplish with MaxPatrol SIEM pilot deployments, which event sources they connect most often, and the kinds of security incidents they detect.
Learn moreFree pilot
If you want to monitor activity on a large network, try MaxPatrol SIEM with its flexible architecture, unlimited scalability, and support for hierarchically organized installations.
Learn more