AthonisOne module 08 of 08

SIEM Analyzer

Your SIEM reports that it is healthy. This asks the estate.

A SIEM can look healthy while whole parts of the estate send it nothing. This module reads the console the way other modules read a firewall — through its own API, read-only — and answers the one question the console can't: is the SIEM actually working?

Request a walkthrough All eight modules

What it answers

The questions this module exists for.

01 Is the estate forwarding? Which machines we own send security events, and which send nothing at all?
02 Are the feeds healthy? Which log sources and data connectors have gone quiet, or never delivered?
03 Is the detection content alive? Which rules we curated have produced anything, and is the data they depend on ingested at all?
04 Did the migration land? What came across between consoles, and what did not?
05 Which stages of an attack could our enabled detections catch, and which have nothing written against them?

What it checks

In detail.

Coverage — the estate the SIEM does not hear from

A coverage map per fleet: which of your firewalls, switches, routers and database servers a console actually hears from, and which send nothing. A device counts as covered only while something is delivering, and cloud feeds are not counted as inventory gaps.

Feed health

Log sources judged on the console's own last-event time rather than its status field — because a source can look healthy and be silent.

Detection content that is alive

Curated rules that produced nothing, kept separate from the ones that cannot fire because nothing feeds the data they read. Detections reading a table the workspace does not ingest are grouped per table rather than per rule — a vendor's table rename can leave a hundred rules looking healthy and reading nothing.

Which attack stages have coverage

Which stages of an attack your enabled detection content could catch, and which have nothing written against them — read from the MITRE ATT&CK tactics your console labels its own rules with, never inferred. A map of what is deployed, not a promise of what would fire.

The migration diff

While an organization moves between consoles: what came across, what arrived switched off, and the curation left behind — measured while the migration is still happening. QRadar and Sentinel can be connected at once and measured in the same pass.

Typed findings

Each with the evidence behind it, not just a severity label.

Finding Wiki

A built-in explainer on every finding — what it is, why it matters, what to do.

A posture score

Rolled up from the findings and trended over time.

Compliance evidence

Findings mapped to the framework controls they evidence.

How it judges

Where it refuses to over-claim.

A check that guesses produces false findings, and false findings teach a team to ignore the real ones. These are the places this module holds back.

It never collects events. No event content, payload or log data is read, stored or displayed. To report how often a rule fired, the module asks the console to count its own activity and reads back the counts — never the events behind them.
A console whose token may not enumerate the deployment reports its topology as unread, not as empty.
The QRadar security profile decides which log sources the account can see at all, so it is shown on the Connections page beside the console version — a coverage figure through a restricted profile is a different question answered.
Curated means a rule a person wrote, changed or deliberately grouped, as distinct from stock content.

What it reads

Connected to what you already run.

IBM QRadar

Managed hosts, every log source with the identifier the console matches events on, and the detection content — rules, building blocks and the groups they sit in. No events, ever
Microsoft Sentinel

Data connectors and what each is delivering, analytic rules and whether each has produced an alert, the tables the workspace ingests and how long it keeps them. No events, ever

What it never does

The boundary, stated plainly.

Never collects events. Inventory, configuration and counts only — what was logged belongs to the SIEM.
Never writes to the console. A read-only role is sufficient.

Findings from this module evidence the logging-and-monitoring control areas of every activated framework.

Works with

One dataset, so the modules answer each other.

Network

Network and endpoint inventories are the estate the coverage map measures the SIEM against.

Read the module →

Endpoint Compliance

Devices the directory owns, checked for whether anything is delivering their events.

Read the module →

See what SIEM Analyzer would say about your estate.

Licensed on its own, and on the same platform as every other module. We'll show you the answer — and what it would say it couldn't measure.

Request a walkthrough Back to AthonisOne