Every host. Every event. One defence.
Threat detection, file integrity, vulnerabilities, compliance and automatic response for servers, workstations, cloud and containers, in one platform. Developed by Pulsar, implemented and supported in Angola by iSoft.
From first event to containment
One agent on every server, workstation and cloud workload feeds a SIEM with thousands of detection rules mapped to MITRE ATT&CK, file integrity monitoring, vulnerability detection, CIS configuration checks and compliance reports, with automatic responses that contain an attack as soon as it is detected. It runs in your data centre.
Detect
SIEM rules mapped to MITRE ATT&CK, on every server and workstation.
Protect
File integrity, vulnerabilities and CIS configuration checks.
Respond
Automatic containment and a timeline for every incident.
Prove
PCI DSS, GDPR, HIPAA, NIST and TSC evidence whenever it is asked for.
Cloud and containers
AWS, Azure, Google Cloud, Microsoft 365, Docker and Kubernetes in the same view.
Visibility
Dashboards, search across every event and scheduled reports for management.
What changes with FireLinks
For IT and security teams with servers, workstations and cloud services.
11 modules. One defence.
Choose a module to see its screen and what it does.
Agents & log collection
One lightweight agent on every endpoint, every log in one place.
A single agent on Windows, Linux and macOS collects system and application logs, process and network inventory and security events, and ships them to the FireLinks manager over an encrypted channel. Agentless sources such as firewalls, switches and syslog devices are collected too.
- Agents enrolled in groups, with central configuration.
- Syslog, Windows Event Log, auditd and application logs decoded out of the box.
- System inventory: packages, processes, ports, users and hardware.
Threat detection & SIEM
Thousands of rules mapped to MITRE ATT&CK, scored by severity.
Every event is decoded, correlated across hosts and time windows and evaluated against a set of detection rules, each tied to its MITRE ATT&CK tactic and technique. Alerts carry a level from 0 to 15, so the team handles what is serious first.
- Rules and decoders you can extend to your own applications.
- Correlation across hosts and time windows.
- Threat intelligence lookups on IPs, hashes and domains.
File integrity monitoring
Know who changed what, where and when.
Critical files, folders and registry keys are watched in real time or on a schedule. Every creation, change or deletion is recorded with the user and process responsible, the hash before and after and, when enabled, the exact difference.
- Real-time monitoring of system and application folders.
- The user and process behind each change.
- Alerts on unexpected binaries, web shells and configuration drift.
Vulnerability detection
Every installed package checked against the CVE feeds, continuously.
The software inventory of each agent is compared with the vulnerability feeds of the operating system vendors and the NVD. Each finding carries its CVE, CVSS score, affected package and fixed version, and is closed automatically once the update is installed.
- Coverage for Windows, Linux distribution and macOS packages.
- Prioritisation by CVSS and by the number of hosts affected.
- Reports per host, per package and per severity.
Security configuration assessment
Hardening checked against CIS benchmarks, host by host.
Each agent runs configuration checks based on CIS benchmarks and Pulsar policies: password rules, services, permissions, logging and network settings. Every check reports pass or fail with the remediation, and the score of each host is tracked over time.
- Benchmarks for Windows Server, Linux, Docker, Kubernetes and databases.
- Custom policies written in the same format.
- Remediation guidance on every failed check.
Regulatory compliance
PCI DSS, GDPR, HIPAA, NIST 800-53 and TSC evidence, generated by the platform.
Alerts and checks are tagged with the controls of PCI DSS, GDPR, HIPAA, NIST 800-53 and the Trust Services Criteria. Dashboards show the coverage of each framework and reports collect the evidence an auditor asks for: access control, integrity, logging and vulnerability management.
- Dashboards per framework and per control.
- Scheduled PDF reports for auditors and management.
- Retention of the events behind each control.
Malware & rootkit detection
Signatures, behaviour and file scans on every host.
Rootkit checks look for hidden processes, ports and files; YARA rules and VirusTotal lookups scan new and changed files; anomalies in system calls and known malicious behaviour raise alerts. Suspicious files can be quarantined by an active response.
- Checks for hidden processes, ports and kernel-level anomalies.
- YARA scanning of new and modified files.
- VirusTotal and threat-feed hash lookups.
Active response & incident handling
Block, isolate or quarantine automatically, then investigate.
Alerts trigger automatic actions on the host: block an IP in the firewall, disable an account, kill a process, quarantine a file or isolate the endpoint. Every action is logged, reverted after a set timeout and tied to the alert that caused it, with the timeline the team needs to close the incident.
- Built-in responses for Windows and Linux, plus your own scripts.
- Timeouts and allow-lists, so responses stay safe.
- Incident timeline with the alert, the action and the team's notes.
Cloud & container security
AWS, Azure, Google Cloud, Microsoft 365, Docker and Kubernetes in the same view.
Cloud audit trails and security services are pulled through their APIs: CloudTrail, GuardDuty, Azure Activity, Google Cloud logs, Microsoft 365 and GitHub audit. Docker and Kubernetes events, images and running containers are monitored with the same rules as hosts.
- Cloud configuration checks against CIS benchmarks.
- Container runtime events and image inventory.
- Identity events: sign-ins, privilege changes and key creation.
Dashboards, reporting & threat hunting
Every event searchable, every indicator on a board.
The FireLinks dashboard shows alerts by severity, host, rule and MITRE technique, with drill-down to the raw event. The team searches months of events, builds its own boards and schedules reports; management receives a weekly summary.
- Pre-built boards for security events, integrity, vulnerabilities and compliance.
- Full-text search over the retained events.
- Scheduled PDF reports and alert routing by email, Slack or ticket.
Deployment & operations
In your data centre, on one or several servers.
FireLinks runs on your premises on a single server or a high-availability cluster, with the indexer sized to the retention you choose. iSoft installs it and keeps the rules and threat feeds up to date. Data never leaves your network unless you decide it should.
- One server or a cluster with indexer replication.
- Role-based access, single sign-on (LDAP and SAML) and an API for integrations.
- Updates, rule feeds and backups handled by iSoft.
What you can do with FireLinks
Brute-force sign-in attempts
A run of wrong passwords on a server raises an alert and the source IP is blocked in the firewall.
Unauthorised file changes
A change to a configuration file or a new web shell is detected and recorded with the user and the process.
Patching plan
The list of vulnerabilities by severity and by host tells the team what to update first.
Audit preparation
Reports per framework collect the evidence on access, integrity, logging and vulnerabilities.
Malware on workstations
A suspicious file caught by the YARA rules is quarantined and the event goes on the timeline.
Cloud and containers
AWS, Azure, Microsoft 365 and Kubernetes logs are monitored with the same rules as servers.
Technical data sheet
Agents, detection, protection, compliance and architecture.
Where FireLinks runs
Events, alerts and evidence stay wherever your organisation decides.
On your premises
Manager, indexer and dashboard in your data centre. Events, alerts and evidence never leave your network.
Managed SOC service
Installed on your premises and monitored by the analysts of Pulsar's SOC.
Hybrid
The platform on your premises, rules and feeds maintained by iSoft, your team on the dashboard.
Licensing
Per monitored agent: project, subscription or managed SOC service, set in the proposal.
FireLinks documentation
The 11 modules, delivery and deployment options in a 16-page document, in English.
FireLinks: product brochure
Modules, detection, protection, compliance, response, delivery and deployment options.
How iSoft implements FireLinks
One local team, from the first survey to the first alert and beyond.