diff --git a/docs/assets/sekoia_system.png b/docs/assets/sekoia_system.png new file mode 100644 index 0000000000..71ebd3549a Binary files /dev/null and b/docs/assets/sekoia_system.png differ diff --git a/docs/cti/index.md b/docs/cti/index.md index 586b0029ec..2f0a2cb81c 100644 --- a/docs/cti/index.md +++ b/docs/cti/index.md @@ -1,5 +1,10 @@ # Sekoia Intelligence (CTI) +!!! note + + Sekoia intelligence is available on Sekoia SOC platform with a Defend licence or as a standalone product thanks to API integration. + + Cyber Threat Intelligence is at the core of cybersecurity operations. Everyone can trigger indicators when damage has already happened. Conversely, showcasing high volumes of indicators is easy when these are long expired. Contrary to other threat intel tools, every single bit of information presented on our feed is framed within explicit validity timestamps and constantly updated, so that you are presented with relevant intelligence, just in time. @@ -9,6 +14,12 @@ Our 500+ sources of information help us track over 200 attackers groups and thei At Sekoia.io, the **Intelligence Center** is a Threat Intelligence knowledge base that is being constantly updated by Sekoia.io's analysts. + +
+ + + + ## Product Features ### Consume and Investigate diff --git a/docs/xdr/index.md b/docs/xdr/index.md index 1c059ef9c6..404e97a701 100644 --- a/docs/xdr/index.md +++ b/docs/xdr/index.md @@ -1,8 +1,15 @@ -# Sekoia Defend (XDR) +# Sekoia Defend -Sekoia Defend (XDR) is **an eXtended Detection and Response platform** that automates your SOC. +!!! note "Licensing & Ecosystem" + Sekoia Defend is the foundational module of the Sekoia AI SOC Platform. It operates as a **standalone product** for detection and response. Its capabilities can be seamlessly extended by integrating **Sekoia Intelligence** (also available standalone), or by activating the **Reveal** and **Elevate** modules. -It allows you to easily integrate and analyze the events produced by your applications, endpoints, cloud and SaaS perimeters in real time, and we designed it with the sole purpose of protecting your assets from potential cyber threats. + +Sekoia Defend makes it possible to easily integrate and analyze the events produced by your applications, endpoints, cloud and SaaS perimeters in real time, and we designed it with the sole purpose of protecting your assets from potential cyber threats. + + + +
+ ## Product Features diff --git a/docs/xdr/sekoia_solutions.md b/docs/xdr/sekoia_solutions.md new file mode 100644 index 0000000000..e030740b89 --- /dev/null +++ b/docs/xdr/sekoia_solutions.md @@ -0,0 +1,39 @@ +# The Sekoia AI SOC Platform + +The Sekoia AI SOC Platform is an open, cloud-native security operations ecosystem designed to unify detection, investigation, and response. Built for performance and analyst efficiency, the platform moves beyond traditional silos by correlating high-fidelity **Cyber Threat Intelligence (CTI)** with real-time telemetry and **Asset Intelligence**. + +By leveraging an "Agentic SOC" approach, Sekoia enables security teams to automate repetitive tasks and focus on complex threat hunting, significantly reducing both Mean Time to Detect (MTTR) and operational overhead. + + +## Platform Architecture & Modules + +The platform is modular, allowing organizations to deploy specific capabilities as needed while maintaining a unified data schema and workflow. + +### Core Components (Standalone) +* **Sekoia Defend:** The central detection and response engine. It provides a robust SIEM-alternative environment to collect, normalize, and analyze logs. It includes native SOAR capabilities to orchestrate remediation through automated playbooks. +* **Sekoia Intelligence:** An industry-leading CTI platform that provides actionable insights into attacker infrastructure, malware patterns, and strategic trends. It can be used as a standalone intelligence source or integrated natively into Defend for automated correlation. + +### Expansion Modules (Add-ons) +* **Reveal (Asset Intelligence):** An exclusive module for Defend that provides continuous asset discovery and inventory. It contextualizes alerts by mapping them to specific organizational assets, ensuring visibility across shadow IT and ephemeral cloud resources. +* **Elevate (Agentic SOC):** A specialized AI module that deploys intelligent agents to assist analysts. Elevate autonomously connects disparate incidents, enriches alerts with active CTI, and prioritizes critical threats to streamline the decision-making process. + +![SEKOIA Licence system Overview](/assets/sekoia_system.png){: style="max-width:100%"} + + +## Engineering Principles + +* **Integration-First:** Hundreds of pre-built connectors and a powerful API-first architecture ensure seamless ingestion from any cloud, SaaS, or on-premise source. +* **OCSF & Sigma Support:** We leverage open standards for data normalization and detection logic, preventing vendor lock-in and allowing for easy rule portability. +* **Scalability:** A multi-tenant, cloud-native backend designed to handle massive ingestion volumes without the management burden of legacy infrastructure. + +!!! info "Licensing Architecture" + While **Defend** and **Intelligence** function as independent products, **Reveal** and **Elevate** are integrated modules that require an active Sekoia Defend license to operate. + +## Read more +Explore the technical specifications and configuration guides for each component of the Sekoia ecosystem. + +- [Sekoia Defend Overview](/xdr/index.md) +- [Sekoia Intelligence Overview](/cti/index.md) +- [Reveal: Asset Intelligence Overview](/xdr/features/modules/reveal_index.md) +- [Integration Library: A comprehensive catalog of supported log sources, intake formats, and transport protocols (Syslog, HTTPS, Cloud-to-Cloud)](/integration/index.md) +- [Sekoia API Reference](/developer/quickstart.md) diff --git a/mkdocs.yml b/mkdocs.yml index 497c557762..8f9d267e2f 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -81,6 +81,7 @@ nav: - Best practices: getting_started/best_practices.md - Troubleshooting tips: getting_started/get_troubleshooting_tips.md - Sekoia Solutions: + - Sekoia's environment: xdr/sekoia_solutions.md - Threat Context (Intelligence): - Intelligence overview: cti/index.md - Data Models: cti/features/data_model.md diff --git a/theme/overrides/home.html b/theme/overrides/home.html index afdf24fc30..88743c238d 100644 --- a/theme/overrides/home.html +++ b/theme/overrides/home.html @@ -21,7 +21,7 @@

Explore by category

Get Started - Sekoia Solutions + Sekoia Solutions Guides Sekoia Integrations API documentation