Security Vision has released a major update to its SIEM platform. The new version monitors not only external attackers but also the stability of the data sources feeding the system, the performance of correlation rules, and the progress of ongoing investigations by analysts.
One of the key additions is monitoring for collection stability. Administrators can now oversee each individual source, configure acceptable deviations in event volume, and receive automatic notifications when events suddenly cease. This capability is intended to surface blind spots proactively rather than after an incident has already occurred.
A separate dashboard displays the quality of correlation rules. Rules can be tested against simulated events, and the platform supports import and export in Sigma format, simplifying the transfer of detection content between different systems.
The StatAnalyser service tracks atypical behavior using statistical rules and marks suspicious incidents with a dedicated indicator. Investigations benefit from a new retrospective process-chain builder inside each incident card. The system automatically runs additional queries to reconstruct parent processes, user sessions, and lateral movement across hosts, giving analysts a more coherent view of the compromise instead of isolated events.
The platform also monitors the SOC team itself. A new dashboard tracks SLA compliance during incident handling and allows managers to drill from aggregate statistics down to the performance of individual analysts.
Together these features aim to create a closed, manageable cycle for SOC operations: verify that data is actually arriving, assess detection quality, identify anomalies, reconstruct attack paths, and oversee team response. The updated SIEM is positioned as an active control point for the entire investigation process rather than a passive log repository.
