AccelOps’ open API allows users to integrate any public or private threat feed into AccelOps, and cross-correlate it with your own network and security data.

The Threat Intelligence Center incorporates “Content as a Service” (CaaS) capability to aggregate, validate and share anonymous threat data gathered from the AccelOps customer base, providing benchmark and threat detection intelligence to customers in real time. Also included are additional device support, rules updates, reports and other knowledge bases.

Visual Analytics generates actionable insights from events and logs in AccelOps. Interact with your data in powerful new ways that make it easy to communicate the value of security and performance monitoring to executives, customers, and line of business owners. Turn performance metrics into answers needed to understand cost of service delivery. Turn security events into answers needed to understand which user behaviors most impact external threat vulnerability.

With new drill down heat maps, geo maps, bubble charts, and pie charts designed for smartphones, tablets, and large screens, it’s easier than ever to translate the operational value of AccelOps into business value.

More info

The Windows Agent provides file integrity monitoring and one-touch deployment to the entire network.

Integrations with leading cloud application vendors make AccelOps the logical choice for progressive service providers delivering security and performance monitoring solutions across hybrid SaaS and on-prem applications.

Support for Amazon CloudTrail allows full AWS API monitoring to enable security analysis, resource change tracking, and compliance auditing.

Support for Okta single sign-on via SAML 2.0 allows AccelOps customers using Okta to automatically be logged into AccelOps via Okta authentication. Additionally, AccelOps rule and report conditions can be defined based on user activity in Okta such as account changes and login behavior.

Support for Box cloud storage file monitoring allows configuration change detection for any files stored in Box. File security monitoring is supported to detect when individual files or directories have been viewed or downloaded. File property monitoring is also supported to monitor file sharing status, password policies, and whether or not file preview is enabled.

The workflow integration API creates bi-directional workflow integration into leading IT service management and ticketing solutions. Users can now create alerts, tickets and incidents from platforms such as ServiceNow and Connectwise, or vice versa, as well as the ability to customize workflow integration and drill down to obtain deep-dive contextual diagnostics for faster problem analysis and resolution.

Machine-generated logs generally lack contextual information needed to make decisions. Other IT operations tools depend on continuous human input of contextual information, AccelOps conducts automatic discovery.

By discovering information from various sources (e.g. SNMP, WMI, SSH, LDAP, VM SDK, etc.) and levels (e.g. physical, virtual, network, storage, user, application) AccelOps creates a Machine Intelligence Database representing the infrastructure and all interrelationships. Information is categorized into functional assets and application classes, resulting CMDB objects usable in searches and rules.

Advanced threat management is achieved from a combination of AccelOps’ robust features including:

Analysis of security devices, sFlow and NetFlow data, CMDB classifications, Statistical Anomaly Detection, CPU, disk, memory and network performance, threat feeds, and advanced rules.

Multi-tenant capabilities allow both service providers or enterprises to cross-correlate multiple organizations or locations from a single visual interface.

AccelOps offers powerful event correlation for connecting patterns of events over time across all IT domains. Bad behavior in machine data can be encoded in rules.

Discovered Machine Intelligence Database objects can be used to sharpen rule conditions. Dynamic contextual metadata such as geo-location are automatically appended to events and then used in rule definition. Rule parameters can be learned from statistical profiling that is continuously being updated in the background.

AccelOps event correlation architecture is unique in two ways:

The entire streaming mode computation is done in memory and does not depend on
      creating index first.

Real-time rule evaluation is done in parallel over multiple AccelOps nodes using patented
      algorithms.

AccelOps cross-domain context-aware event correlation helps predict security threats and IT operational issues. The rules can correlate any machine data and adapt to changing conditions because of profile driven parameterization. Rule computation can instantly scale to increased loads because of the distributed architecture and virtualization platform.

AccelOps stores original raw log messages, parsed attributes and enhanced data elements. Real time or historical data can be purged, archived and trended over time.

Searches can be simple or complex using regular expression orstructured SQL-like query statement. There is no system limitation on the amount of data that can be processed or stored within AccelOps.

AccelOps is the only Security Incident and Event Management (SIEM) solution that provides discovery-driven, real-time situational awareness to security logs, resulting in quick IT response. The awareness comes from dynamic usage profile of infrastructure assets, their current configurations, recent changes, dynamic asset to business service mappings, user discovery from Active Directory and OpenLDAP databases, identity and location of every IP address involving mobile devices and statistical baselines of network traffic, system and application metrics.

The awareness also comes from continuously updated external threat intelligence sources in the form of IP reputation, domain reputation, malware user agent and malware hashes.
The situational awareness is appended to logs and enables AccelOps rule engine to correlate the information in real time to generate accurate actionable intelligence alerts and reports.

No matter the data type, whether performance metrics, database logs, security logs or configuration changes, AccelOps pre-processes all data into searchable events.

AccelOps allows both Google-like keyword and regular expression based searches on unstructured machine data, as well as field-based searches on structured machine data. Searches can be executed in real-time on streaming data or on stored historical data. Discovered CMDB objects can be utilized to help facilitate search conditions to narrow results.

One-click drill-down capabilities for refining search criteria streamlines root-cause analysis. Searches can be executed in parallel on multiple AccelOps nodes for fast results. The results can be visualized as time trends, pie and bar charts, scatter plots, bubble charts, heat maps, geo maps and tree maps.

AccelOps’ unique multi-tenant design enables Managed Service Providers (MSPs) and enterprises that run their business as service providers to do their jobs more efficiently. By sharing compute, bandwidth and storage resources across organizations and seeing their customers’ environments from a single pane of glass, service providers using AccelOps can achieve tremendous efficiencies.

AccelOps allows multiple organizations to be defined within the same instance, both remote hosting/colocation and remote management. Each organization can see and interact with its own data, while service providers can cross-correlate all data across their customers.

Hundreds of rules and reports can run either in the context of a single organization or across all organizations. 

Traditional dashboards focus on only a few metrics by showing TopN devices for each of those metrics. After a dozen or so metrics, the dashboard becomes congested with too much detail. What if a particular device has a problem and you need a bird’s-eye view of all the metrics for that device?

AccelOps provides a unique dashboard that enables users to instantly compare any number of metrics for any number of devices –  both current values and trends over the current day. This Infinite Matrix View, powered by an in-memory time-series database, enables customers to visually drill down on the root causes of issues quickly.

In a large organization with different kinds of equipment, it is important to constantly understand what is a normal baseline.

How many connections are typically permitted or denied by the firewall?

How many errors are typically seen on servers?

How many logons are there to the domain controller or the database servers?

What is the IO rate from storage systems?

Once baselines are known, deviations can be detected. AccelOps can baseline any collected performance metric or flow data and create alerts when anomalies are detected. Fine-grained baselines are created on an hourly basis for each distinct hour of the day and separately for work and non-work days.

The baselines are learned automatically and updated continuously in an attempt to learn the new normal. AccelOps enables baselines on any metric and allows users to customize the amount of deviation they want to see from normal behavior.

Dynamic Watch Lists allow IT to track frequent security policy violators, such as accounts that frequently get locked, countries that most often scan your network, or workstations that turn off anti-virus programs.

AccelOps alerts administrators on users who violate policies. Watch Lists can be dynamically populated when a rule triggers. AccelOps provides 20 common Watch Lists connected to one or more of AccelOps’ system rules. Users may customize these lists or create their own, depending on their needs.

AccelOps provides role-based access control. Role can have limits on GUI views, editing, execution and population. By writing simple queries, data constraints are applied.

This approach creates parameters per role for analyzing data on shared devices. Traditional built-in roles are provided, however custom roles can be created with restricted GUI view and data constraints. Role-based access control combined with flexible external authentication via LDAP directories provides a solid foundation for enterprises and service providers.

Would you like the flexibility to detect an issue at a remote location that you are monitoring?

AccelePort Remote Access allows administrators to launch a secure terminal session from a browser and resolve the issue immediately without the need for a jumpbox. AccelOps multi-tenant architecture gives users a secure, one-click method to access remote devices. Simply select a remote device and AccelOps will know the associated AccelOps Collector and build a remote SSH tunnel from that Collector to the Supervisor node without the need to open an inbound firewall port.

AccelePort works natively for protocols for which browser plugins are available, e.g., SSH/Telnet, VNC, RDP, HTTP(S) and more.

AccelOps provides an innovative architecture that seamlessly collects data from any component regardless of the deployment scenario: on premise, cloud or a combination.

AccelOps correlates the data and presents the results in an integrated manner. AccelOps also makes it easy to test a feature in a public cloud, as well as manage migration from a public to a private cloud.

AccelOps provides users the ability to define a Business Service as a “smart container” of systems and applications serving a specific business purpose. A setup wizard that uses discovered information, including network topology, installed applications and traffic flow, guides users to create a business service.

AccelOps then tags every incident with the impacted business service, making it easy to prioritize tickets. AccelOps also computes Business Service health based on the health of all the component systems and applications, enabling trending against past values. 

AccelOps analytics, whether for compliance or security threat mitigation, is rooted in the product’s world-class, dynamic and automated discovery. Once discovered, all devices and applications are approved so that the next discovery process catches unapproved systems and applications.

AccelOps also discovers network device configurations and alerts to any configuration changes.

Synthetic Transaction Monitoring enables IT to simulate through tests, the way users navigates systems. Tests could be against the web front-end, database engines or email systems that report problems.

Users can test a website (e.g. Salesforce.com) by recording a series of user actions via the Selenium browser plugin and playing it back in AccelOps via a headless browser. Synthetic Transaction Monitoring enables users to anticipate and catch problems before they affect internal performance metrics.

AccelOps demonstrates to security auditors that collected logs have not been tampered with while at rest within the AccelOps system. To achieve this, logs are cryptographically signed immediately upon arrival at the AccelOps point of entry.

The checksums are stored in a database. An auditor can verify the log integrity from the AccelOps GUI simply by choosing a time period and running a check. If some logs have been found to be tampered with, AccelOps can identify the time period for of the affected logs.

Device support is automatically provided after AccelOps analyzes, discovers and automates a given environment. If a new devices is added to the environment, AccelOps automatically discovers, maps and supports that device as part of the overall environment.

AccelOps offers deep storage monitoring for direct attached, network attached storage (NAS) and storage area networks (SAN).

Using vendor-specific APIs, AccelOps can discover detailed storage architecture, including hardware details and host to LUN to Storage Pool to Physical Disk mappings. By combining storage usage metrics from the host, virtualization and NAS/SAN layers, AccelOps can also calculate critical performance metrics such as latency, read and write rates at host, LUN and Storage Pool levels.

These usage patterns can be baselined on a hour of day and day of week basis and anomalies can be quickly detected

AccelOps conducts deep analytics on compute, network and storage resources, whether entirely or partially on-premise or in the Amazon EC2 cloud. Users can monitor their Amazon EC2 activity and resource usage from the same console used to their on-premise datacenter.

By deploying a native AccelOps Collector inside the EC2 cloud, information can be collected at specified time intervals lending insight into behavior.

Using VMware’s API, AccelOps understands relationships from physical servers, ESX hosts, guest operating systems and virtual connectivity. AccelOps generates visual representation of an ESX environment. Relationships are mapped in the CMDB to give layer-2 and layer-3 topography.

Guest operating systems are mapped to physical ESX host and clustered servers. Real-time dashboards show current statuses and alerts while historic searches provide detailed information on the VMware infrastructure.

AccelOps can handle enormous workloads and scales by adding virtual machines (VMs) to a cluster. Powered by multi-threaded architecture and in-memory, real-time data sharing, an 8-core AccelOps node can handle up to 10,000 events per second – or 1 terabyte of events per day. AccelOps collects and parses events, runs 50 in-line system reports and checks against 400 real-time rules.

Add AccelOps Collectors to offload parsing and rule/report processing to increase real-time event processing. Add disks for more storage or IOPS capacity. Resources on VMs can be increased and new VMs spun up and added to the AccelOps cluster. No data migration required and there is minimal downtime.

AccelOps  is a virtual appliance that can be deployed in any environment. AccelOps runs on all major hypervisor platforms: VMware ESX, Red Hat KVM, Microsoft Hyper-V, Amazon EC2 and Citrix Xen.

AccelOps runs in any public cloud infrastructure, including Amazon Web Services (AWS), Google Compute Engine and Microsoft Azure. As scope expands, AccelOps can seamlessly move from physical machines to more powerful machines, or from private to public or public to public cloud environments.