- How to Buy
- Contact us or one of our partners for information on how to buy
- Request a Demo
See how NitroView can work for you … register now
Detecting Data Loss & Fraud
For enterprises looking to protect against data loss with a more efficient and cost-effective solution, content-aware SIEM is the perfect solution. CA-SIEM can track and analyze how protected information is accessed and used on the network, to detect unintentional data loss, deliberate theft of data, and violations of business policies that could put sensitive information at risk.
Because NitroView is built for the analysis of database activity and application data contents in addition to logs and events, it's able to detect data loss and fraudulent insider activity — all from a single platform using a single interface.
- Overview
- Supported Apps
- Supported Protocols
- Supported Databases
These capabilities go far beyond what is offered by other SIEMs — rather than relying on database and application logs to detect threats against your data, we're able to provide active monitoring: providing full database session visibility to know exactly what data is being accessed, when, and by who; and going beyond surface visibility of application logs to detect sensitive data within the applications themselves.
Many SIEM products claim fraud detection and "application support." However, these systems rely on application logs, which provide varying degrees of application event detail depending upon the application. Some systems go even further to provide analysis of packet header information, to tie specific events to a given application. Both solutions lack the full depth of application monitoring that can be provided using a dedicated Application Data Monitor (ADM).
Unlike logs and packet headers, full ADM provides visibility into the application's content—including:
- Text within an email or the contents of an email attachment
- Instant message conversations and the contents of files transferred over IM
- The presence of sensitive or protected information
- The absence of corporate privacy statement in outbound emails
- Virtually any policy violation based on how applications and documents are used
Applies to: NitroView ADM
Archives
Images
Audio
Video
Messages
Databases & Spreadsheets
Fax
Web Related Applications
Executables
|
Games
Application Specific Documents
3D Modeling
Anti-Virus
Disk Images
Scientific: Chemical Modeling
Scientific: Mathematical Modeling
Software Development
Microsoft Windows Related
UNIX Related
Apple Mac OS Related
Fonts
Network Analysis
|
Applies to: NitroView ADM
Base Protocol Modules
- AOLMAIL (AOL Webmail)
- DeltaSync (Windows Live Mail over Outlook client)
- FTP
- Gmail
- Hotmail
- HTTP
- IRC
- MAPI (Microsoft Exchange)
- MSNMS SQL Server
- SQL queries
- Network Printers (Print monitor, PJL, postscript, PCL)
- NNTP
- OSCAR (ICQ, AOL Instant Messaging)
- Peer to Peer / Gnutella
- POP3
- SIP (IM / VoIP)
- SMTP
- SSH
- SSL
- Telnet
- XMPP / Jabber IM
- Yahoomail
- Yahoo Webmail
- YIM
Low-Level & Transport Protocol Modules
- DNS
- IPv4
- KERBEROS
- NBNS
- RPC
- RTP
- SOCKS
- TCP
- UDP
Network Modules
- BASE64
- DNS (IP -> Name Cache for Use by Modules)
- GZIP
- HU01 (Compression used by windows live mail)
- IPv4
- KERBEROS (Windows Login Detection)
- LZFU (Compression used by MAPI / TNEF)
- MARKUP (Text Extraction from HTML for Indexing)
- MIME (Email and Web Form Decoding)
- NBNS (Names for MAC Addresses from Windows)
- QP (Quoted Printable decoding)
- RFC822 (Email Decoding)
- RPC
- RTF (Text Extraction for Indexing)
- RTP
- SMB
- SOCKS (Proxy Server)
- TAR (Archive extraction)
- TNEF (Winmail.dat files)
- TCP
- UDP
- ZIP
WebMail
- AOL
- GMAIL
- Hotmail
- Yahoo
- Webmail supports extraction of:
- Email contents
- Attachment Name
- Bcc
- Cc
- Display Name
- File Name
- Host Name
- From
- To
- Subject
Instant Messenger / Chat
- AOL
- ICQ
- Jabber
- MSN
- SIP
- Yahoo
- IM / Chat supports extraction of:
- Message Contents
- Call ID
- Client Version
- Contact Name
- Contact Nickname
- Display Name
- File Name
- User Name
- User Nickname
VoIP Protocol Modules
- SIP
- SIP Supports extraction of:
- Call ID
- Client Version
- Contact Name
- Contact Nickname
- Display Name
- File Name
- User Name
- User Nickname
Database Protocol Modules
- TDS (MS SQL Server)
- TDS Supports extraction of:
- App Name
- Ctl InternalName
- Database
- Host Name
- Password
- Server Name
- User Name
* NitroView DBM supports full database monitoring of all databases
Decompression & Decoding Modules
- BASE64
- GZIP
- HU01
- LZFU
- MIME
- Quoted-Printable
- RFC822
Content Extraction Modules
- HTML
- RTF
- TAR
- TNEF
- ZIP
SCADA and DCS Protocols
- DNP3
- Ethernet/IP
- ICCP
- Modbus
- Others (see SCADA & DCS tab for more details)
Applies to: NitroView DBM
Note: Log collection and analysis of additional databases may be supported using NitroView ESM or NitroView ELM
Supported Database Platforms
- DB2
- Informix
- MS SQL
- MySQL
- Oracle
- PI Server
- PostgreSQL
- Sybase
- Teradata
