Reasons to Choose AccelOps

Eliminate blind spots in virtualized and dynamic environments by auto-discovering assets to be secured. Security policies are automatically applied by identifying the speicfic make, model and version of asset. These reduce security gaps and management costs.

Target security resources to the most business impacting events. AccelOps allows users to compose business services based on discovered data. Thus incidents are automatically associated with Business Services and presented in business service dashboards. Some vendors require you to navigate dashboards from disparate products assembled through acquisitions. AccelOps natively provides this capability.

Add support for ANY custom event log collection and parsing without losing performance. Collection enabled by syslog, JDBC, JMX etc. through easy to extend XML based scripts. Some vendors may allow for extensibility but that always involves a performance penalty. AccelOps’ patent pending technology breaks this trade-off. You are no longer dependent solely on vendor cycles for all additions, minimize security risks by reducing coverage gaps faster.

All events are enriched with full-context as they are received, in streaming mode, allowing for easy application of context-rich patterns and rules. No more data synch issues since the context is right there on each event as it happens. Through dynamic in-memory joins AccelOps automatically adds user and application context to events in real-time. Real-time and historical searches are automatically enriched – no more complex queries to build to impart basic context such as users and applications.

AccelOps provides industry’s most advanced correlation engine to correlate temporal pattern based rules with keyword combinations and expressions. Analytics is distributed across multiple compute nodes to easily scale with demand. Other vendors that support “centralized analytics” require fork-lift upgrades when you need to increase event handling capacity. These increase management costs and create discontinuities in security management.

AccelOps combines firewall logs and netflow data that is sessionized, de-duplicated, profiled based on day-of-week, day-of-month, business hours and after-hours to detect deviations from a normal profile. AccelOps also detects open server ports, P2P traffic, botnet traffic, mail virus, (D)DoS – distributed analysis (IP). Some vendors may offer some network flow analysis but it is not discovery driven – hence the analysis is only as good as the data that’s manually input. AccelOps provides a complete network picture at all times.

Rapidly triage security issues by knowing exactly what changed in your environment. Track changes from server, network, storage, virtualization, software, installed patches and applications. No need to integrate multiple disparate products to obtain data that should be just one click away.

Optionally access performance and availability metrics across any element in the environment – not just routers like other vendors. Obtain a 360 degree view of the impact of security incidents to prioritize precious resources.

AccelOps provides real-time and historical search across all data without limits. Centralized storage architecture enables enterprises to store data going back months and years. Unlike other vendors that limit search to log data AccelOps allows search against any and all indexed attributes and CMDB data. Search based on keyword combinations and expressions.

Incident trend reports drive process improvements and better decisions. AccelOps provides multiple types of incident views; incidents layered on an IT topology, Calendar views, fishbone views and calculation of MTTR based on ticketing system data.

Bubble up the most important incidents and reduce incident noise. Policy based notifications automatically notify personnel based on incident severity, time of day, affected business service etc. Repeated low-priority or known incidents can be automtically suppressed by the system thereby freeing up time for more critical issues.

Track users as they move across locations and access devices. User-server connectivity is established and displayed in real time enabling precise remedial action based on policy violations. Identify the real user behind shared administrative credentials and alert by matching user’s role with permissible activity. Some vendors offer static exports of user identities into their SIEM product; this approach is not scalable and introduces new security vulnerabilities.

Automically kick off remedial action based on incidents such as multiple log-in failures from geographically separate locations within a small time window. AccelOps’ ability to detect events against any parsed attribute allows users to write precice rules and conditions. Automate with confidence and certainty that the right action is taken under the right conditions.

AccelOps is a virtualized software-only solution based on a ‘distributed compute and centralized storage’ architecture. Scale to handle higher EPS simply by adding virtual machines to the AccelOps cluster. Upgrades of other vendor products involve replacing vendor supplied hardware and complex, error-prone data migration.

AccelOps’ virtualized software based solution delivers high availability through industry-standard vMotion and DRS technologies. Other vendors require duplicated, expensive hardware in stand-by mode to support HA. This not only involves untested proprietary HA techniques but also doubles the hardware costs and upgrade costs.