MaxPatrol SIEM All-in-One provides full visibility into small to mid-sized IT infrastructures and detects security incidents. Get a full-featured SIEM system that works, even on a smaller budget.

Age controls for asset data. Unlimited incident storage. More performance tools. The new version of MaxPatrol SIEM offers plenty of reasons to upgrade.

Learn more

For companies with small but important infrastructures

If your IT infrastructure stores sensitive data and a hack could harm your company's reputation, bottom line, or operations, it's time to build a security system that works. MaxPatrol SIEM All-in-One helps to spot hacking activity inside your network before it's too late and facilitates investigation.

Comparison: All-in-One vs. MaxPatrol SIEM

MaxPatrol SIEM All-in-One MaxPatrol SIEM
Architecture Simplified: no components for deep traffic analysis, malware scanning of files and emails, or analytics to assess overall security across distributed infrastructures Customized to client needs, infrastructure size, and events per second (EPS) threshold
Scalability License available for up to 1,000 hosts. One data collection agent per license. Unlimited scalability. Multiple installations can be arranged hierarchically.


The core components of MaxPatrol SIEM All-in-One are deployed on a single hardware server provided together with the software. Two components, PT Retro Correlator (for retrospective analysis) and PT Update and Configuration Service (for online updates), require additional virtual or hardware servers.

1. MaxPatrol Core

Management server

2. MaxPatrol SIEM Server

Processes security events. Performs event aggregation, filtering, normalization, and correlation. Automatically creates incidents. Relates events to information assets.

3. MaxPatrol SIEM Events Storage

Stores security events in a central location. Includes Elasticsearch 7.4.2.

4. MaxPatrol SIEM Agent

Performs black-box and white-box scanning of assets. Collects events.

5. PT Knowledge Base

Provides expertise packs, macros, and normalization rules, as well as information about security bulletins and software on assets.

6. PT Update and Configuration Service

Ongoing updates of MaxPatrol SIEM components: checks for, downloads, and installs new component versions. Updates expertise packs, macros, normalization rules, and vulnerability databases.

7. PT Retro Correlator

Rechecks previously received events using the correlation rules.

Component diagram

Схема взаимодействия компонентов

In our report, learn what clients expect to accomplish with MaxPatrol SIEM pilot deployments, which event sources they connect most often, and the kinds of security incidents they detect.

Learn more

If you want to monitor activity on a large network, try MaxPatrol SIEM with its flexible architecture, unlimited scalability, and support for hierarchically organized installations.

Learn more