Security monitoring for Windows networks
Detects attacks early, rates them by severity and reports them where your team works – entirely inside your own network.
A traditional SIEM is too big, too expensive and too much work to run for many companies. ComSiem is the lean alternative: an agent analyses the Windows event logs of your network and only reports what really looks like an attack.
Pilot phase – we are looking for companies and IT service providers to deploy ComSiem with us
The sign-in protection base module is always included; four further modules can be added.
Brute force on single accounts, password spraying across many accounts, distributed attacks from many addresses and sign-in attempts with non-existent accounts – on workstations, servers and domain controllers, for Kerberos and NTLM. Plus an alert when a domain controller or an important server stops delivering events, for example because forwarding has failed.
New or re-enabled accounts, additions to privileged groups – including your own admin groups –, account lockouts and Kerberoasting attempts against service accounts.
Cleared security logs, new services, scheduled tasks and suspicious PowerShell scripts. Typical attacker paths and tools are rated higher.
Microsoft Defender detections and actions, disabled real-time protection and newly added exclusions.
Active Directory changes attackers use to dig in: shadow credentials, delegation, SID history, DCSync rights and changed group policies. Plus password data pulled via DCSync, admin sign-ins via RDP or over the network from a new source, signs of pass-the-hash and pass-the-ticket, and decoy accounts: accounts nobody uses, so any use of them raises a critical alert at once.
No cloud required: apart from your domain controllers, the agent only connects to your own alert channels, i.e. mail server and Teams. Suitable for isolated networks too.
Ongoing attacks keep counting in the same alert, repetitions are bundled. Notifications configurable per alert type, exceptions for known admin tools with a stated reason and, if you like, an expiry date.
Plain text on accounts and addresses only goes to your own alert channels. Teams cards can show tokens only, retention periods are configurable, exports are logged.
Dashboard, alerts with history, failed sign-ins and settings in one place. Sign-in with your Windows account, access restricted to a defined group.
Installation via MSI, setup wizard, no separate database server. The installer sets up Active Directory auditing, the console shows which Windows settings are still missing.
For companies with a Windows environment and IT service providers looking after customer networks – without an in-house 24/7 security team.
ComSiem is in its pilot phase. If you would like to deploy ComSiem in your network or at your customers’ sites, or have questions, write to us or give us a call.
