What communication is taking place?
You want to understand which systems in the selected area communicate with each other and with external destinations.
ASSESSING A SIEM ALTERNATIVE
You want to understand your network.
Do you need a SIEM for that?
If your first question is which systems communicate with each other and which connections warrant closer assessment, targeted network analysis can be a suitable starting point. AEGYS Pulse captures communication in the agreed network area.
START WITH THE TASK
What do you want to answer first?
A specific alert or suspicion is not required. Existing security measures and expert teams remain part of the assessment.
Which observations warrant closer assessment?
You want to identify unusual connections and changes and assess them in the context of your operations.
Which information are we still missing?
You first want to gather insight from your own environment before planning the further development of your security monitoring.
ASSESS THE APPROACHES
Network analysis and SIEM address different tasks.
| Criterion | Network analysis with AEGYS | SIEM |
|---|---|---|
| Starting point | Communication at the agreed capture point. | Aggregation and analysis of security information from connected sources. |
| Typical question | Which connections and communication patterns are observed? | Which security-relevant events can be correlated across different sources? |
| Preparation | Agree the area in scope, capture point, and analysis. | Define data sources, use cases, and operating model. |
Starting point
- Network analysis with AEGYS
- Communication at the agreed capture point.
- SIEM
- Aggregation and analysis of security information from connected sources.
Typical question
- Network analysis with AEGYS
- Which connections and communication patterns are observed?
- SIEM
- Which security-relevant events can be correlated across different sources?
Preparation
- Network analysis with AEGYS
- Agree the area in scope, capture point, and analysis.
- SIEM
- Define data sources, use cases, and operating model.
A SIEM can also include network data. What matters is which information and processes your requirements call for.
STARTING WITH AEGYS
Start with a clearly defined network area.
- 01
Define the question
We discuss what you want to understand about your network communication and which area should be examined.
- 02
Connect the prepared appliance
Your IT team connects the appliance at the agreed capture point. We assist with the setup to the agreed extent.
- 03
Assess the results
The captured communication provides points for assessment. Together, we define how the analysis is carried out and who takes responsibility for the next steps.
FIT
When this starting point fits your task.
- Your question primarily concerns communication in the network.
- You want to examine a defined area first.
- You want to use the resulting insights for further decisions.
If you want to bring together more data sources
If your requirements also include central analysis of numerous applications, identities, and endpoints, these sources and the intended operating processes should be considered in your selection. We clarify what AEGYS can actually contribute.
ANALYSIS AND OPERATION
Analysis is part of the decision.
Alongside the technology, it is important to establish who assesses observations and initiates actions. Before deployment, we agree which tasks your team or service provider handles and what support AEGYS provides.
EXISTING MONITORING
Do you already use a SIEM?
Then the central question is which additional insights network analysis can contribute to your existing operational picture.
View SIEM complementFREQUENTLY ASKED QUESTIONS
Questions about a SIEM alternative.
NEXT STEP
Which insight do you need first?
Describe your starting point. We discuss whether targeted network analysis is a suitable first step and what scope would make sense.
Discuss a suitable starting point