H3C SecCenter CSAP-SA

Diverse data collection

Supports collecting logs from various network devices, security devices, operating systems, servers, middleware, and databases.

Actively collects logs in real time from network entities through FTP, JDBC or ODBC, log collection agent on endpoints, or databases. Alternatively, passively accepts logs reported by network entities through SYSLOG, HTTP, HTTPS, sFlow, NetStream, or SNMP.

Supports unified management of endpoints that are installed with the log collection agent.

Multi-dimensional log audit

Supports predefined and user-defined log audit rules to trigger security event alarms.

Supports classification search, full-text search, and standard detail information display for massive logs.

Supports data storage, data backup, and full lifecycle management of the logs.

Multi-dimensional risk warning

Performs data correlation analysis from multiple dimensions to detect potential security issues.

Performs multidimensional data correlation analysis by using built-in analytics rules to quickly detect attack behaviors and illegal accesses.

Ecological connectivity

Supports acting as distributed log collectors for a cybersecurity situation awareness platform, so as to adapt to many network scenarios.

Provides standard APIs to allow access of third-party security logs.

Acts as a standard component to connect to other platforms to synchronize data, for example, connect to security devices, security analysis systems, and security SaaS services.

The platform collects, consolidates, and conducts correlation analysis for different types of logs from a wide variety of sources, and presents the logs visually in real time, which will help security personnel to identify security events quickly and accurately. In addition, it provides a range of report templates, to help users to audit the security status of enterprises and organizations from different perspectives.