The VOGO eBS SIEM collectors and agents
The audit events of servers, applications, databases and network devices.
VOGO eBS SIEM
See everything that happens in the infrastructure and respond automatically
SIEM — Security Information and Event Management. The audit events of servers, applications, databases and network, collected in one place, correlated and turned into incidents the team investigates and closes.
Installed at the organisation, as a virtual appliance. Security data never leaves your infrastructure.
- Detection and UEBA
- Automated playbooks
- GDPR, NIS 2, ISO 27001
VOGO eBS SIEM
A single place for the security events of the whole system
Every server, application and network device sends its events to a central platform, which correlates them and brings up only what matters: behavioural anomalies, indicators of compromise and attacks in progress.
The analyst gets the incident with its full context — the source, the user, the assets touched, the timeline — and investigates it from the same console. Repetitive responses are run by the playbooks: blocking an address, isolating a workstation, opening a ticket.
Compliance reports are produced from the same data, for internal audit and for the authorities.
Collection. Correlation. Response. Compliance.
Centralised collection
Logs from operating systems, applications, databases, virtualisation, firewalls and network devices, through agents or syslog.
Correlation and detection
Delivered and custom correlation rules, mapped to MITRE ATT&CK, with a severity level on each alert.
UEBA
The normal behaviour of each user and system is learned; deviations from the pattern become alerts.
Indicators of compromise
Addresses, domains and files known to be malicious, updated from threat intelligence sources.
Incident investigation
Search and filtering across all events, the incident timeline and the assets involved, on a single screen.
Automated playbooks
Predefined responses, triggered automatically or by the analyst: blocking, isolation, notification, ticket.
Compliance reports
GDPR, NIS 2, ISO 27001, PCI DSS, NIST and best-practice reports by technology.
Retention and archiving
Online events for investigations and the long-term archive, with no volume limit in the licence.
What makes the product different
Ready-installed virtual appliance
All components in a single image for VMware, KVM or Hyper-V, configured and hardened by VOGO.
Reports for the required standards
Report templates for ISO 27001, SOX, COBIT, FISMA and NIS 2, besides the best-practice reports.
Delivered playbooks
A library of ready-to-use playbooks for frequent incidents, adaptable without programming.
Link with Service Desk
Each confirmed incident automatically opens a ticket in VOGO eBS Service Desk, with its SLA.
Support, updates and training are provided by VOGO, as the product’s manufacturer.
VOGO eBS SIEM — a single integrated product
The correlation and UEBA engine
Correlation rules, learned normal behaviour and indicators of compromise.
The event store
Search across online events and the long-term archive, with no volume limit in the licence.
Response orchestration
Automated playbooks for blocking, isolation, notification and tickets.
VOGO eBS SIEM Console
The analyst console in Romanian, incident investigation and compliance reports.
The product uses as mature open-source libraries: Wazuh, OpenSearch, Shuffle and MISP.
Frequently asked questions
What is VOGO eBS SIEM?
It is the VOGO security event monitoring product: it collects, correlates and analyses the audit events of the whole infrastructure and helps the security team investigate and respond to incidents.
Is it a VOGO product?
Yes. VOGO eBS SIEM is an integrated product, developed, licensed and supported by VOGO, with VOGO modules, console and support. The product uses as mature open-source libraries: Wazuh, OpenSearch, Shuffle and MISP.
Where does it run?
On premise, in the organisation’s infrastructure, as a virtual appliance. Events never leave the infrastructure.
Does it help with NIS 2 and GDPR compliance?
Yes. Audit events are kept and can be retrieved, incidents have full traceability, and compliance reports are produced from the same data.
How is it licensed?
The licence does not limit the volume of the online database and of the archive. Commercial terms are set on request.
Request a demo
See how VOGO eBS SIEM works
Request a demo on your organisation’s event sources.
Note: The services are provided in line with the European DNSH principle – “Do No Significant Harm”, in accordance with Article 17 of Regulation (EU) 2020/852 on the establishment of a framework to facilitate sustainable investment and with the European Commission’s technical guidance on the application of the DNSH principle, C/2023/111.