The ISA manage component enables setup of user groups and data access rights. Groups may be defined and users inputted and assigned to those groups from a single view. Data access rights can be assigned to groups to establish controls over user access to sensitive data.
ISA offers the ability to control data sources throughout setup, testing, operation and publishing, including the ability to add and suspend data sources. ISA provides support for logstash, RSS, CSV, S3, and various API’s. In addition, the advanced source builder option allows you to add and edit JSON directly.
ISA operates through a project workspace, providing logical groupings of data sources and users. The ISA workspace allows alignment of users with data sources to help ensure integrity of data access and preserve the confidentiality of sensitive data.
ISA includes a series of reporting tools providing the ability to compare threats and vulnerabilities, assign risk levels, and track cost information, all to help you to determine your optimal security strategy.
ISA also offers a threat feed tool to aid your team in determining the ongoing value of threat feeds over time. Additional visualizations are provided to help in identifying patterns across netflow data and indicators of compromise most relevant to your team.
Integration w/ Third Party Tools and Applications
ISA supports the use of multiple third party tools and applications. ISA facilitates cleansing of data to enable ease of sharing with many of these tools and applications. ISA is also directly integrated with a growing number of third party applications. This includes Kibana, which can be accessed directly within ISA, enabling direct comparability of log information.
ISA provides data filtering and organization tools to enable you to quickly identify relevant data. Search options range from verb categories to a selection of entity options and include the ability to tag and save past searches. Once search queries are executed, further filtering options offer additional focus across multiple predefined options, such as recent, oldest and relevance.