It has to fit your SOC.
ProLion is where the file events happen. Your team works somewhere else — so the events go there, in formats those tools already read.
Syslog CEF and REST, into the tool you already run
What ProLion reads, and what it reports to
Three places an event has to arrive.
SIEM & SOAR
Splunk, Microsoft Sentinel, IBM QRadar, Elastic. Syslog CEF and REST, with blocking and quarantine triggered from your playbooks.
ITSM
ServiceNow and Jira Service Management — an incident with the account, the file list and the action already on it.
Identity
Entra ID, Okta, SAML and OIDC for sign-in, Active Directory for resolving what a group actually means.
The full list.
Let’s solve your data challenges.
Connect with our engineers to find the right approach for your infrastructure.
What leaves the building.
The events you choose to forward, to the destinations you configure. Nothing else: the platform runs on your own hardware, including at sites with no outbound connection, and file contents are analyzed where they already sit.
- No endpoint agents— nothing to roll out, nothing to keep updated
- No log shipping from clients— the file system’s own event stream is the source
- No cloud analysis— classification and detection run on your appliance
Talk to an engineer who knows your data.
Four fields, and somebody who knows ONTAP, PowerScale and what FPolicy does. Not a qualification call.