Rempart Detect. Your logs, read day and night.
Detect is the first module of the Rempart service. It gives you visibility on what is happening in your environment and detects malicious activity 24/7.
Four channels into the Security Data Lake
Each source reaches Rempart through the channel that suits it: an agent on workstations and servers, Syslog for network devices, the providers' APIs for the cloud and for your Microsoft 365 tenant.
Workstations & servers
AgentAn agent is deployed on your Windows, Linux and macOS endpoints, configured automatically to collect system and application logs.
Other equipment
SyslogThe vendor-neutral Syslog protocol ingests and normalises the streams of network equipment (VPNs, routers, firewalls), printers, IoT devices and any compatible equipment.
Cloud services
APICloud environments are ingested through the providers' secure APIs: your existing EDR, document management systems and more.
Microsoft 365 & Entra ID
Microsoft APIYour tenant's mail, identities, applications and administration, read through the Microsoft APIs.
Security Data Lake
Detection engine
A native agent for each OS
No cross-platform abstraction layer: each operating system has its own agent, built for the events and telemetry APIs specific to it.
The footprint stays light and collection is thorough where it counts: processes, files, network and security logs.
The agents are delivered ready to deploy with your usual fleet management tools, with no manual configuration.
All architecturesx86_64aarch64arm64armhfi386powerpcintel64
Your equipment, without an agent
Collection beyond endpoints follows one simple principle: your sources push their streams out to Rempart, never the other way round. No inbound rule to open into your infrastructure.
Syslog is a universal protocol
Any network equipment, peripheral or connected device that speaks it can feed Rempart Detect. All it takes is to send the streams to the IP address of your Rempart appliance. Collection, normalisation and correlation happen on the platform.
Your network
VPN · Routers · Firewalls
Network and internal LAN equipment: VPNs, routers, switches, perimeter and internal firewalls.
Printers & MFPs
Network and multifunction printers that support Syslog, often forgotten in monitoring plans.
IoT & industrial devices
Controllers, sensors and other connected equipment exposing a Syslog stream, including on OT segments.
Any compatible equipment
Any other equipment or service supporting the protocol can be ingested and normalised with no specific development.
Syslog, outbound
No inbound rule
Syslog, outbound
No inbound rule
Cloud services, Microsoft 365 first among them, connect through their official APIs, with no appliance. What Rempart reads in Microsoft 365
Detection
Over everything that happens in your environment: workstations, servers, network and cloud.
A vulnerability base that grows every year
Your fleet is checked continuously against every published vulnerability, across distributions and ecosystems. The portal keeps only those that affect your hosts.
- 400,000+
- CVEs listed
- 180,000+
- Products covered
- 16 million+
- Affected packages
CVEs by source · indicative split
CVEs by year · published worldwide
Measure the hardening of each device
The same agent checks each host against the CIS benchmark for its system, Windows, macOS or Linux, and derives a pass rate. You see the posture of the whole fleet, each benchmark applied and, device by device, the controls that fail.
A deliberate gap is declared as an accepted risk from the portal: it stays on record but leaves the count, so the score measures what remains to be fixed.
From detection to response
The agent deployed for collection can also run response actions on the host: block an address, isolate a workstation from the network or disable an account. No additional component is needed, and these actions run alongside your antivirus or EDR rather than replacing it.
- 1
Automatic
Triggered by a rule
Some detection rules trigger an immediate action, according to the policy defined with you.
Trigger
SSH brute force, 47 failures from the same source
Action
Source blocked
Outcome
Source blocked · reversible · logged
- 2
On demand
Triggered by an analyst
From the portal, analysts launch a targeted action on a specific host.
Trigger
Suspicious process detected on a workstation
Action
Network isolation of the host
Outcome
Host isolated · investigation under way
- 3
CSIRT cell
First tier included in Rempart Detect
Subscribing to Rempart Detect includes a first incident response package: it covers the analysis of and response to P1 and P2 events.
Trigger
P1 or P2 incident confirmed by an analyst
Action
Analysis and response by SecuLabs experts
Outcome
Remediation and return to normal
AI working for the SOC
Our team of data scientists puts artificial intelligence at the heart of the service, with three concrete aims applied to every alert before it reaches an analyst.
A backup policy at 11 pm?The AI will know.
Your batch of Windows KBs on the 15th of the month?The AI will know that too.
- 1
Classification
Alerts are qualified and ranked by severity, so that efforts go to the incidents that are truly critical.
- 2
Fewer false positives
Noise is filtered out before it reaches you: only the alerts that matter get through.
- 3
Full context of your systems
The AI takes your environment and its habits into account, to tell the unusual from the routine.
Detection aligned with MITRE ATT&CK
MITRE ATT&CK is the global framework that catalogues the tactics and techniques attackers actually use. All of Rempart's detection is aligned with it.
Built on attacker behaviour
Detection targets real attack techniques, not just known signatures.
Every alert in context
Every alert is mapped to a tactic and a technique: your teams know at once where the attacker stands.
Measurable, auditable coverage
Coverage is mapped tactic by tactic, with a verifiable finding rather than a marketing promise.
Keep exploring
Interested in this service?
Let's discuss your specific needs and build a solution suited to your context together.