Sekoia Defend - Next-Gen SIEM

Sekoia AI SOC platform provides eXtended threat Detection and Response through a unified SaaS platform with Threat Intelligence. The Threat Landscape feature provides real-time insights on critical threat risks. Roy is a cybersecurity AI assistant that investigates threats, detects TOR network activity, accesses documentation, and provides information on emerging threats like APT29 and GRU. The platform includes over 250 integrations for collecting logs from information systems. The rules catalog contains over 1000 pre-built detection rules created, verified, and maintained by threat intelligence analysts. Detection rules are operationalized with contextual CTI and behavioral analysis to reduce false positive rates. The MITRE ATT&CK Matrix shows detection coverage based on enabled rules. The platform uses three detection engines: correlation, CTI, and anomaly detection. All events sent to the platform are automatically scanned against a database of 7 million Indicators of Compromise (IOCs) from the Sekoia.io Intelligence Center. Retrohunting capabilities automatically scan historical events for newly added IOCs. When a new IOC is added to the CTI database, the platform searches both current and historical logs. The Threat Intelligence Context section provides detailed contextual information compiled by threat intelligence analysts. Graph investigation visualizes what triggered an alert and the relationships between objects. Playbooks enable automation and remediation actions. Users can create custom playbooks that run in the cloud, on-premise, or both.