DBAPPSecurity Log Auditor (BYOL)

Mingyu Comprehensive Log Audit Platform consists of a collector, communication server, correlation engine and platform manager. The main functions are as follows:

1. Comprehensive log collection It fully supports protocols such as Syslog, SNMP, OpSec, XML, FTP and local files, and can cover mainstream hardware devices, hosts and applications to ensure comprehensive collection of log information. Logs of information assets (network devices, security devices, hosts, applications, and databases) can be obtained, and logs are analyzed, filtered, and aggregated through preset parsing rules. At the same time, the collected logs can be forwarded to other network management platforms through the forwarding function.
2. Large-scale secure storage Built-in TB-level storage devices, and various RAID levels can be selected for data redundancy and security. The system has multiple storage and encryption mechanisms and retrieval mechanisms with independent intellectual property rights, which are very suitable for application requirements in industries such as security and cryptography.
3. Intelligent correlation analysis It realizes full-dimensional, cross-device, and fine-grained correlation analysis, has many built-in correlation rules, supports network security attack and defense detection, and compliance testing, and can easily perform correlation analysis between assets.
4. Vulnerability Management It can collect and manage scan results from various web vulnerability scanning tools, host vulnerability scanning tools, and network vulnerability scanning tools, and perform three-dimensional risk correlation analysis with attack risks received from user assets in real time.
5. Data mining and data prediction It supports data mining and analysis of historical log data, discovering potential correlations between logs and events, and visualizing the mining results. The system comes with a variety of statistical data prediction algorithms, which can effectively predict future data occurrence according to the rules of historical data.
6. Visual display It enables real-time monitoring of information assets, management of information assets and customers, definition and distribution of analysis rules and associated rules, statistics and reports of log information, storage and rapid retrieval of massive logs, and platform management. Through naturalized processing of various events, high-performance mass event storage and retrieval optimization functions are realized, and high-speed event retrieval capabilities are provided. Subsequent compliance statistical analysis processing enables secondary mining and analysis of the data.