The Mingyu Comprehensive Log Audit Platform consists of a collector, a communication server, a correlation engine, and a platform manager. The main functions are as follows:
1. Comprehensive log collection
It fully supports protocols such as Syslog, SNMP, OpSec, XML, FTP and local files, and can cover mainstream hardware devices, hosts and applications to ensure comprehensive collection of log information. Log acquisition of information assets (network devices, security devices, hosts, applications, and databases) is realized, and logs are analyzed, filtered, and aggregated through preset parsing rules. At the same time, collected logs can be forwarded to other network management platforms through the forwarding function.
2. Large-scale secure storage
Built-in terabyte-level storage devices, and various RAID levels can be selected for data redundancy and security. The system has a number of storage encryption mechanisms and query mechanisms for independent intellectual property rights, and is very suitable for application requirements in industries such as security and security protection.
3. Intelligent correlation analysis
It enables full-dimensional, cross-device, and fine-grained correlation analysis. It has many built-in correlation rules, supports cybersecurity attack and defense testing and compliance testing, and can easily achieve correlation analysis between assets.
4. Vulnerability Management
It can collect and manage scan results generated from various web vulnerability scanning tools, host vulnerability scanning tools, and network vulnerability scanning tools, and perform three-dimensional risk correlation analysis with the attack risk received by user assets in real time.
5. Data mining and data prediction
It supports data mining and analysis of historical log data, finds potential correlations between logs and events, and visualizes the mining results. The system comes with a variety of statistical data prediction algorithms, which can effectively predict future data occurrences based on the rules of historical data.
6. Visual display
It realizes real-time monitoring of information assets, management of information assets and customers, definition and distribution of analysis rules and associated rules, statistics and reporting of log information, storage and rapid retrieval of massive logs, and management of platforms. Through naturalized processing of various events, high-performance massive event storage and retrieval optimization functions are realized, and high-speed event retrieval capabilities are provided. Post-factual compliance statistical analysis processing enables secondary mining and analysis of the data.