Sold by: WitFooÂ
Deployed on AWS
Free Trial
WitFoo Precinct is a Diagnostic Security Operations (SECOPS) Platform built to enable organizations to mature SECOPS
Overview
WitFoo Precinct is the world's first and only Diagnostic SIEM. Precinct is a Big Data stack that consumes and analyzes syslog, NetFlow, Agent, API and Cloudwatch data to provide near real-time intelligence on security threats and attacks. Precinct allows customers to detect deficiencies that will lead to attacks so they never occur. Automation and Orchestraction occurs using the best practices of law enforcement and cybersecurity operations to enable all organizations to stay ahead of threats. WitFoo threat intelligence is anonymously shared between WitFoo deployments to illuminate emerging attackers and attacks. WitFoo Precinct is security, leveled up.
Highlights
- Big Data Security Operations Platform
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 22.04 LTS
Deployed on AWS
Unlock automation with AI agent solutions
Fast-track AI initiatives with agents, tools, and solutions from AWS Partners.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 30 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time. Alternatively, you can pay upfront for a contract, which typically covers your anticipated usage for the contract duration. Any usage beyond contract will incur additional usage-based costs.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
c6a.2xlarge Recommended | $4.56 |
c6a.16xlarge | $41.04 |
t3a.2xlarge | $4.56 |
c6a.12xlarge | $27.36 |
c6a.24xlarge | $54.72 |
c6in.8xlarge | $20.52 |
c6i.16xlarge | $41.04 |
c6in.4xlarge | $9.12 |
c6i.8xlarge | $20.52 |
c6i.12xlarge | $27.36 |
Vendor refund policy
30-day trial is free; No refunds after purchase
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA)Â .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Next major release of Precinct code base.
Additional details
Usage instructions
- Deploy AMI
- Configure Security group to allow access to 514/udp, 514/tcp and 6514/tls for syslog as appropriate
- Configure Security group to allow access to 5044/tls for Agent data as appropriate
- Configure Security group to allow access to 2055/udp for NetFlow as appropriate
- If Internet access is restricted, the Instance must be able to reach https://library.witfoo.com and https://registry.witfoo.comÂ
- If deploying multi-tier architecture, WitFoo Precinct nodes should be able to communicate with each other over 443/tcp, 6514/tcp, 9042/tcp, 7000/tcp and 7001/tcp.
- Log into to new instance via SSH
- Run sudo ./register (see the following video for instructions: https://vimeo.com/422153063Â )
- After 5-10 minutes of initialization and updates, the UI can be accessed via HTTPS. Status can be checked by running ./status
- Installation checklist can be found here: https://community.witfoo.com/forums/topic/witfoo-precinct-deployment-checklist/Â
- Training, forums and support can be found at https://community.witfoo.comÂ
Resources
Vendor resources
Support
Vendor support
Email, Phone, Community, In-person https://community.witfoo.com/Â support@witfoo.comÂ
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Graylog, Inc.
By Securonix, inc
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Data Analytics
Big Data stack consuming and analyzing multiple data sources including syslog, NetFlow, Agent, API, and Cloudwatch
Threat Detection
Near real-time intelligence on security threats and attacks with proactive deficiency detection
Threat Intelligence
Anonymously shared threat intelligence between deployments to illuminate emerging attackers and attacks
Security Automation
Automation and orchestration using best practices from law enforcement and cybersecurity operations
Multi-Source Data Ingestion
Comprehensive data collection from diverse sources including cloud, network, and agent-based telemetry
Log Management
Centralized log management solution with comprehensive data collection and analysis capabilities
Search Performance
Ability to search terabytes of log data in milliseconds with high-speed query processing
Security Analytics
Integrated security analytics and incident investigation features for threat detection and response
Platform Flexibility
Open-source platform with REST API and support for AWS OpenSearch, enabling easy integration with existing tech stacks
Data Exploration
Advanced data exploration capabilities that support unstructured query searching and comprehensive log investigation
Threat Detection Analytics
Advanced AI-powered analytics with precise security decision-making capabilities
Cloud Integration Architecture
Cybersecurity mesh architecture supporting multi-cloud environments and seamless integration with security tools and data lakes
Data Storage and Processing
Snowflake data cloud backend supporting hundreds of thousands of events per second with hot searchable data retention for extended periods
Threat Content Management
Continuous delivery of curated threat content with extensive coverage powered by Threat Labs expertise
Incident Response Automation
AI-reinforced platform with automated response capabilities aligned with MITRE ATT&CK and US-CERT threat models
Standard contract
No
No
No
Customer reviews
T Rudolph
A Complete Solution
Reviewed on Feb 08, 2021
Review from a verified AWS customer
We evaluated several options when looking for a SIEM solution and happened upon witfoo. We have been amazed at witfoo's ability to provide a complete solution which not only allows threat aggregation and investigation, but incorporates accurate threat detection and a powerful SOAR engine for customizable responses.
The rollout of new versions on a regular basis has provided additional features such as multi-tenancy, aggregation nodes, and we are excited for the release of their future reporting enhancements.
Many companies talk the talk, witfoo delivers! I encourage anyone in search of a powerful SIEM solution to check out witfoo's demo or spin up an instance in AWS.