Datasheet

Blockbit SIEM & SOAR

SECURITY INFORMATION AND EVENT MANAGEMENT & SECURITY ORCHESTRATION, AUTOMATION AND RESPONSE

Intelligent Monitoring

Security Automation

Orchestrated Threat Response

Blockbit SIEM & SOAR is an integrated event management and incident response automation solution, designed to deliver advanced detection, event correlation and proactive mitigation.

Combining artificial intelligence, machine learning and automation, the solution provides complete cybersecurity visibility, accelerates incident response and reduces the operational workload of SOC teams.

Native integration with Blockbit Cyber Threat Intelligence (CTI) and Blockbit Sandbox further strengthens detection and response, enabling dynamic analysis of suspicious files and real-time correlation with global intelligence. In addition, advanced dashboards such as MITRE ATT&CK Framework, MITRE Radar, Attack Map and customizable panels provide a strategic view of adversary tactics and techniques, threat trends and network behavior.

Blockbit SIEM & SOAR is compatible with more than 150 market technologies, enabling comprehensive integration with network devices, firewalls, NDR, EDR, XDR, identity systems and various other security solutions, ensuring unified visibility and coordinated response across the organization’s entire security ecosystem.

Solution Differentiators:

Intelligent Threat Detection

Advanced event correlation and behavioral analysis to identify attacks in real time.

Advanced Dashboards

Strategic visibility with MITRE ATT&CK Framework, MITRE Radar, Attack Map and custom dashboards.

Response Automation and Orchestration

Automated playbooks reduce the need for manual intervention and accelerate mitigation.

Behavioral Analysis and UEBA

Identification of suspicious user and entity activities to detect lateral movement and insider threats.

Integration with Blockbit CTI

Global threat intelligence, enriching alerts and reducing false positives.

Unified Incident Management

Complete event traceability and detailed auditing.

Native Integration with Blockbit Sandbox

Dynamic and automated analysis of suspicious files, detecting unknown and evasive threats.

Monitoring and Compliance

Customized reports to meet LGPD, GDPR, ISO 27001, PCI-DSS and other standards.

Integration with Blockbit XDR, NGFW & NDR

Event monitoring and correlation, automatic application of blocking rules, detection and mitigation of advanced attacks.

Deployment Flexibility

Available for on-premises, public cloud, private cloud or hybrid environments.

Main Features

Event Collection and Correlation (SIEM)

Continuous Monitoring: Real-time log normalization and analysis from multiple sources, including endpoints, firewalls and cloud services.
Advanced Correlation: Intelligent algorithms connect isolated events to identify attack patterns.
Behavior-Based Detection: Machine learning to identify anomalous activities and prevent attacks before they occur.

Orchestration and Automated Response (SOAR)

Intelligent Playbooks: Automation of actions such as access blocking, device isolation and automatic notifications.
Multi-Layer Automation: Coordinated response between firewalls, NDR, EDR, XDR, identity systems and other security tools.
Integrated Forensic Analysis: Detailed incident investigation with reconstruction of the attack timeline.

Dynamic Threat Analysis with Blockbit Sandbox

Advanced Malware Detection

Identification of unknown malware, ransomware variants and evasive attacks.

Behavioral Analysis of Suspicious Files

Secure execution of artifacts to identify malicious actions in real time.

Remediation Automation

Integration with SOAR for file quarantine, IOC blocking and coordinated response.

Threat Intelligence with Blockbit CTI

Advanced Data Correlation

Use of global intelligence to validate threats and reduce false positives.

Continuous Updates on New Threats

Insights into malware, targeted attacks and emerging vulnerabilities.

Predictive Detection

Identification of attack patterns before they affect the environment.

Automated Resolution

Application of contextual intelligence-based responses for high-risk incidents.

Advanced Dashboards and Visual Intelligence

MITRE ATT&CK Framework

Mapping of tactics and techniques used by cyber adversaries.

Threat Hunting

Investigation to identify attack patterns and activities hidden from traditional defenses.

Attack Map

Real-time monitoring of active threats and correlation with geolocated data.

Custom Dashboards

Complete customization of reports and charts, adapted to SOC needs.

Time Reduction and Operational Efficiency

With intelligent automation, Blockbit SIEM & SOAR drastically reduces the time required for an advanced 24x7 SOC to detect and mitigate threats.

Task	Manual Process (average time)	With Blockbit SIEM & SOAR
Artifact Enrichment (IOCs)	1 hour	3 minutes
Event Triage	30 minutes	2 minutes
Suspicious File Analysis	2 hours	Automatically/Immediately
Isolation of Compromised Devices	15 minutes	Automatically/Immediately
Incident Documentation	90 minutes	Automatically/Immediately
IOC Blocking in Firewalls	45 minutes	Automatically/Immediately
Complete Incident Resolution	6 hours	5 minutes

Total: Reduction from up to 6 hours to just 5 minutes!

This information is for illustrative purposes only, based on estimates calculated by Blockbit. Each environment and team has unique characteristics that may result in significant variations in the times presented.

SOC Automation and Orchestration

The evolution of cyberattacks and the expansion of the digital perimeter in enterprises require increasingly efficient SOCs. However, the high volume of alerts, lack of integration between tools and absence of automation compromise agile threat detection, investigation and response.

Intelligent Triage and Alert Enrichment:

Reduction of false positives with CTI intelligence and advanced event correlation.

Total Orchestration and Automation

Automatic execution of playbooks for investigation, threat isolation and immediate containment.

Integration with More Than 150 Solutions*

Unification of security tools, providing a coordinated and efficient response.

Reduction in Incident Resolution Time

From hours to minutes, with intelligent automation and complete operational dashboards.

Blockbit SIEM & SOAR transforms the traditional SOC into a highly efficient and automated environment, reducing operational workload and accelerating threat mitigation. With native integration with Blockbit CTI, behavioral analysis and intelligent automation, it transforms cybersecurity into a highly efficient and resilient environment.

Less response time with intelligent automation
Advanced detection and proactive threat mitigation
Visibility and event correlation for a modern SOC
Continuous compliance and auditing to meet regulatory standards

About Blockbit

Blockbit is a leader in cybersecurity products, protecting thousands of companies and millions of users from digital attacks and threats.

+5M: corporate customers
+2MM: protected users

* Log reception via SYSLOG or Logstash (UDP, TCP and TLS)

Features

Features / ItemsSIEM & SOAR

Log collection and integration

Supports ingestion of security and audit logs from more than 150 distinct vendors and technologies, including firewalls, switches, routers, VPNs, WAFs, proxies, servers, databases, applications, cloud services, and perimeter devices.
Supports event collection through multiple methods, including Syslog (UDP/TCP/TLS), lightweight agents on endpoints and servers, APIs, and log file ingestion, enabling operation in agent-based, agentless, or hybrid mode.
Supports native integration with Blockbit NGFW, SD-WAN, and GSM solutions, enabling detailed event collection, deep correlation, and application of remediation actions directly on these devices.
Allows operating in a hybrid manner, combining logs received via Syslog, agents, and API integrations, consolidating network, endpoint, cloud, and application events into a single platform.

Event correlation, detection, and classification

Supports the correlation of logs from one or more devices and their NGFW features, identifying and summarizing distinct events that are related or similar, in order to highlight distributed or multi-stage attacks.
Allows the creation and customization of correlation rules, using context (IP address, user, application, geolocation, reputation, threat intelligence), to detect suspicious behaviors and coordinated attack campaigns.
Allows classification of events, both manually and automatically, regarding their severity (for example, informational, low, medium, high, and critical), facilitating incident prioritization and SOC team guidance.
Allows mapping events and incidents to reference frameworks such as MITRE ATT&CK, NIST, PCI DSS, and other taxonomies, supporting tactical and strategic security analyses.

Thresholds, tolerance, and noise reduction

Allows the definition of configurable thresholds and time windows for tolerance of similar or recurring events, in order to control when a set of events becomes treated as a relevant alert.
Supports grouping, suppression, or elevation of alerts based on volume, frequency, and event context, reducing false positives and optimizing SOC triage.

Response, remediation, and automation (SOAR)

Supports automation and orchestration playbooks, allowing the definition of standardized response workflows for specific types of events and incidents.
Allows automated remediation of detected events through automatic blocks applied on NGFW/SD-WAN devices and other security integrations (for example, blocking IPs, URLs, domains, users, ports, applications, sessions, or compromised credentials).
Allows triggering manual or automated response actions (with optional approval), such as host isolation, access revocation, blocklist/allowlist updates, and ticket creation in ITSM tools.

Reports, dashboards, and visibility

Supports report generation on detected events by criteria such as bandwidth consumption, risk level, application control, source/destination, users, geolocation, threat categories, and compliance.
Allows creating customizable real-time dashboards, including views by risk level, top applications, top traffic sources, top attack types, attack map, incident timelines, and severity distribution.
Supports reports and dashboards geared toward auditing and compliance, helping with standards requirements such as LGPD, ISO 27001, PCI DSS, among others.

Enrichment, CTI, and hunting

Supports enrichment of events and alerts with threat intelligence (CTI) information, IP, domain, and URL reputation, expanding the context available for analysis.
Allows the use of indicators of compromise (IOCs), such as hashes, IPs, domains, and URLs, both for automated detection and retrospective searches in the event history.
Allows proactive threat hunting activities through advanced queries and specific filters across large volumes of logs, identifying attack patterns that were not previously converted into rules.
Supports time-based analysis and historical correlation, allowing verification of whether an IOC or suspicious pattern has occurred across broader time windows.

UEBA, user and asset context

Allows associating events with user identities, groups, and critical assets, facilitating the detection of anomalous behavior and insider threats.
Supports the creation of behavioral profiles for users and devices, allowing the identification of significant deviations from expected patterns.

Search, analysis, and investigation

Allows advanced search across large volumes of logs, with field filters (IP, user, application, hostname, device, event type, severity, geolocation, etc.).
Supports graphical visualizations for trend analysis, event spikes, distributions by source/destination, threat categories, and attack types.
Allows detailed investigation of incidents with a chronological trail (timeline), showing the sequence of events before, during, and after an attack.

Governance, auditing, and compliance

Supports complete audit trails of actions performed on the platform (who did what, when, and from where), meeting governance and compliance requirements.
Allows access profiles with privilege control (RBAC – Role-Based Access Control), restricting viewing and operations according to user role (analyst, manager, auditor, administrator).
Supports reports geared toward regulatory compliance (LGPD, ISO 27001, PCI DSS, among others), presenting evidence of monitoring, incidents, and response actions.

Multi-tenant, scalability, and high availability

Supports operation in multi-tenant mode, allowing logical segregation of environments or clients (for example, MSP/MSSP, business units, or distinct agencies) on a single platform.
Supports horizontally scalable architecture, capable of handling large volumes of logs and events per second, preserving search and correlation performance.
Allows deployment in high availability, with redundancy of critical components and service continuity mechanisms in case of failures.

Notifications, integrations, and ITSM

Supports alert notifications across multiple channels, such as email, webhooks, and integration with collaboration tools (for example, corporate chat systems), accelerating SOC communication workflow.
Allows integration with ITSM/Service Desk platforms (for example, for automatic opening and updating of tickets based on detected incidents).
Supports REST API integrations for querying, ingesting, and exporting data, enabling automation and integration with other security, management, and governance solutions.

Retention, storage, and privacy

Supports configurable log retention policies, with different storage periods according to legal, regulatory, or business requirements.
Allows application of masking or anonymization of sensitive fields (such as personal data) in displayed records, supporting compliance with data protection legislation.
Supports exporting logs and reports in standard formats (CSV, JSON, PDF) for external analysis, audits, or long-term archiving.

The main Part Numbers related to this product belong to the following families: BBXSIEM-SVX-XX, BBXGSM-SVX-XX (Global Security Management), among others.