Use Cases

NitroView supports a variety of both general and high specialized use cases. This is because the performance and flexibility of NitroView support both operational security functions in addition to informational functions associated with log management and compliance.

Below are some examples of how NitroView can be used:

Minimizing Response Time

Event Collection

In order to react quickly and efficiently to a security incident, you need to have easy access to as much forensic data as possible, from all relevant datasources. This means that your SIEM must support diverse security information collection, and make all of that information available for analysis at any moment.

[Includes video demonstration]

Historical Analysis

In order to react quickly and efficiently to a security incident, you need to have easy access to as much forensic data as possible, from all relevant datasources. This means that your SIEM must support diverse security information collection, and make all of that information available for analysis at any moment.

[Includes video demonstration]

Ad-Hoc Analysis

For every security incident that occurs, there are thousands of related events, from user authentications, to network flows, application behavior, and other events. When you're not sure where to look, having a rapid-response SIEM is crucial. NitroView's high-performance data management engine gives you the freedom to explore your data as needed — and there's no need to wait for minutes or even hours between each request for data, because NitroView gives you the results you're looking for within seconds.

[Includes video demonstration]

Threat Management

Predicting Threats

While most SIEM products focus on reporting security incidents that have already occurred, NitroView is able to alert upon any anomalous behavior that might be an indication that a threat is in progress. Similar to network behavior analysis, where traffic volumes, patterns and flows are evaluated against established baselines, NitroView is able to provide Universal Anomaly Detection.

[Includes video demonstration]

Detecting Data Loss or Insider Theft

NitroView's ability to look into the contents of applications to see information within emails, web forms, instant messages, and hundreds of other applications allows for you to be immediately notified when your most valuable information is "in motion.".

[Includes video demonstration]

Detecting Advanced and Blended Attacks

Threat behavior is evolving. With the easy availability of penetration and exploit tools, hackers are able to easily develop new combinations of attacks, consisting of parallel activities, multiple attack vectors, and any number of obfuscation techniques that can make detection extremely difficult.

[Includes video demonstration]

Detecting Access and Policy Violations: NitroView's centralized correlation and analysis of user, network and policy information allows you to easily monitor secure networks, VLANs, or security enclaves within the context of an established communication policy, to notify when unauthorized communications are occurring. This is a critical factor in establishing compliance with NERC CIP's protection of critical infrastructure, as well as the restrictions to sensitive information required by PCI-DSS, HIPAA, SOX and other compliance mandates—while in Department of Defense networks, the same concepts allow you to monitor SIPR networks to ensure there is no unauthorized "leakage" into NIPR networks ...
Read More