One containment record, routed wherever you need it.

When Helm contains an attack, it writes down every step. Through syslog-ng, that record travels the same routes as the rest of your logs, to your SIEM, your archive or any other destination, with no new connection to manage.

The first minutes decide how much ransomware can encrypt. Helm takes charge of those minutes: it spots encryption as it begins, in under a second, and isolates the identities behind it using rules your team can read and check. Each of those actions is logged as it happens.

syslog-ng is a log management solution from One Identity, available as a free open source edition and as commercial editions. It collects log data from many sources and routes it to many destinations, so organisations can run one pipeline instead of a separate agent for every tool. syslog-ng moves the record. Helm makes sure it describes a contained attack, ready to be investigated.

Helm sends its events as standard syslog over UDP or TCP, in plain syslog, CEF or LEEF, so they match what the receiving end expects. Each event carries the files affected, the account and device involved and the action taken. syslog-ng picks them up like any other source and can filter, enrich and forward them to your SIEM, a long-term archive or syslog-ng Store Box for tamper-proof storage.

The proof of what happened then sits wherever your auditors expect to find it.

Helm brings the containment; syslog-ng carries the record on. If you send events straight to a SIEM instead, see how Helm works with Splunk, IBM QRadar and Exabeam.

See all integrations, or talk to us about adding Helm to your log pipeline.