Log analysis can query the original alarms, exception records, and original logs using different query conditions. When a user is a tenant, only the data filtered against the users organizational architecture is displayed.
The Sherlock entrance of threat hunting shows the access and attack connections between the network entities in a complex network. It is supported to select an entity in the connection relationship to view details, or enter the network entity IP to be tracked in the IP address search box to view details.
The system supports modeling analysis, can be customized analysis model.