Attackers start from the bottom of the list
Don't leave anything behind, watch EVERYTHING
Let cost NOT be the barrier for your SaaS Platform
We are flexible, we work with our customers in a way that benefits EVERYONE
Calculate an approximate yearly price for yourself.
Starts at 2,500 |
2,500 EPS |
PROFESSIONAL $ 10,586/mo
annual commit
|
ENTERPRISE $ 14,367/mo
annual commit
|
|
---|---|---|
PRODUCT OVERVIEW | ||
SIEM | ||
UEBA | ||
SOAR | ||
HyperScale Datalake | ||
ENTITLEMENTS | ||
Data Retention | 365 Days | 365 Days |
Data Tiering | Hot / Active | Hot / Active |
Analytic Scheduling | Scheduled, Streaming | Scheduled, Streaming |
Log Volume | Unlimited | Unlimited |
Capacity Upgrades | Real-Time | Real-Time |
SOC2 Reporting | ||
Redundancy Across Availability Zones | ||
Support | 8x5 (P1 24x7) | 8x5 (P1 24x7) |
USE CASES | ||
Active Threat Watch | ||
Cloud Observability | ||
Compliance Monitoring | ||
User Behavior Analytics | ||
Network Traffic Analyitcs | ||
Application Observability | ||
Entity Behavior Analytics | ||
PLATFORM CAPABILITIES | ||
Cloud Connector (Azure, AWS, GCP) | ||
Native Extractors | ||
Threat Intelligence Enrichment | ||
GEO/DB Network Enrichment | ||
Enrichment on Ingest | ||
Schema on Read | ||
Search / Hunting | ||
Data Partitioning | ||
ML Framework | ||
No Code Outlier Detection | ||
SUCCESS MANAGEMENT | ||
Onboarding Program | ||
Dedicated Success Manager | ||
Analyitcs / ML Concierge Service | Optional | |
Maturity Reviews |
Need more choices, we have it covered
Tune your deployment to your needs, install on-premise or build your isolated cloud infrastructure
Frequently Asked Questions
Do we get HOT / COLD data retention?
There are many many advantages of a hyperscalar data platform, and one of those advantage is that it does not discriminate between hot and cold data. Everything is HOT and can be retrieved instantly. So by default you should be able to query 365 days of data without having to wait.
How do I develop extractors? Do I have help?
Extractors are open and you could easily build or modify an extractor using a simple YAML file (no coding required). Option 2 - if this is a publicly available product that you are wanting to extract, you could leave a request for creating a new extractor, this request will be reviewed by the team and added to the roadmap. Option 3 - You could also subscribe for additional professional services (PS) and get the extractor built on priority.
I want to query a field that has not been extracted?
It may not be feasible to extract every field in the raw event, so there may be times when some fields may not have been marked for extraction. In these cases we have the option of augmenting the extractor to include the additional field. However with DNIF you have an additional ability to query a field that was previously not extracted and is available only in the raw event.
This capability is called Schema On Read (SOR) where you could execute a native query on the raw event and extract a field which was not originally extracted. With this method you can query back in time without altering the extractor.
What happens when I use more than my subscribed EPS limit?
It is always prudent to have additional capacity on the EPS front than what is required. This will help the engine surmount bumps in the event generation rate. The ingest engine will allow an ingest rate upto 100% of the subscribed EPS value and then allow a 5% overage (grace) on the subscribed EPS value. In case events are dropped, the counts will be logged and notified.
Can I have my own deployment, on premise?
Yes - you can, DNIF offers a downloadable on-prem version as well which you could install in your environment and be in total control of your data. The downloadable uses Docker containers to deploy and it is fairly easy to install and initiate - although, not as easy as the cloud native SaaS platform 😉
What features are missing in the community edition? Can I use it for commercial use?
Yes - you can use DNIF Community Edition (CE) commercially. Also, it is exactly the same product as you would get in the enterprise version but however without any restriction. The CE version is infact uncapped and can ingest any amount of data / EPS as long as the underlying compute permits the stretch.
The only aspect missing from the CE is the support, you get access to community support instead of dedicated support provided by us.