Overview
WitFoo Precinct is the world's first and only Diagnostic SIEM. Precinct is a Big Data stack that consumes and analyzes syslog, NetFlow, Agent, API and Cloudwatch data to provide near real-time intelligence on security threats and attacks. Precinct allows customers to detect deficiencies that will lead to attacks so they never occur. Automation and Orchestraction occurs using the best practices of law enforcement and cybersecurity operations to enable all organizations to stay ahead of threats. WitFoo threat intelligence is anonymously shared between WitFoo deployments to illuminate emerging attackers and attacks. WitFoo Precinct is security, leveled up.
Highlights
- Big Data Security Operations Platform
Details
Features and programs
Financing for AWS Marketplace purchases
Pricing
Additional AWS infrastructure costs
Type | Cost |
|---|---|
EBS General Purpose SSD (gp3) volumes | $0.08/per GB/month of provisioned storage |
Vendor refund policy
30-day trial is free; No refunds after purchase
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
New major release of Precinct code.
Additional details
Usage instructions
- Deploy AMI
- Configure Security group to allow access to 514/udp, 514/tcp and 6514/tls for syslog as appropriate
- Configure Security group to allow access to 5044/tls for Agent data as appropriate
- Configure Security group to allow access to 2055/udp for NetFlow as appropriate
- If Internet access is restricted, the Instance must be able to reach https://library.witfoo.com and https://registry.witfoo.com
- If deploying multi-tier architecture, WitFoo Precinct nodes should be able to communicate with each other over 443/tcp, 6514/tcp, 9042/tcp, 7000/tcp and 7001/tcp.
- Log into to new instance via SSH
- Run sudo ./register (see the following video for instructions: https://vimeo.com/422153063 )
- After 5-10 minutes of initialization and updates, the UI can be accessed via HTTPS. Status can be checked by running ./status
- Installation checklist can be found here: https://community.witfoo.com/forums/topic/witfoo-precinct-deployment-checklist/
- Training, forums and support can be found at https://community.witfoo.com
Resources
Vendor resources
Support
Vendor support
Email, Phone, Community, In-person
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Customer reviews
A Complete Solution
We evaluated several options when looking for a SIEM solution and happened upon witfoo. We have been amazed at witfoo's ability to provide a complete solution which not only allows threat aggregation and investigation, but incorporates accurate threat detection and a powerful SOAR engine for customizable responses.
The rollout of new versions on a regular basis has provided additional features such as multi-tenancy, aggregation nodes, and we are excited for the release of their future reporting enhancements.
Many companies talk the talk, witfoo delivers! I encourage anyone in search of a powerful SIEM solution to check out witfoo's demo or spin up an instance in AWS.