How Wirespeed Enhances Investigations With SIEM Upgrade

In the last 90 days, Wirespeed has escalated only 2,294 of 8.1 million detections to our customers. This directly translates to less tedious alerts for users and more time to focus on strategic initiatives.

Wirespeed’s automated protection is designed to empower security teams, not replace them. Over the last quarter, we’ve launched new integrations, features, and product updates all designed to enhance your team’s capabilities, support your investigations, and reduce the noise. You’ll find:

- 15 new integrations to connect more of your security stack to Wirespeed

- Managed Detections, fueled by global risk intelligence, to help catch evasive threats

- More data at your fingertips to prove Wirespeed’s ROI to decision-makers

- And more!

New integrations

Wirespeed connects to your existing security tools to provide automated threat detection, investigation, and response. Our integrations are designed to work together by combining detection sources with user directories, endpoint managers, and communication platforms to enable automated protection.

Below, we’re highlighting the new integrations from the past quarter that may be most impactful for our users:

Network & Perimeter Security

- Ubiquiti UniFi: Monitors physical and perimeter network infrastructure, capturing syslog telemetry from gateways and access points.

Email & Workspace Security

- Perception Point / FortiMail: Inspects messaging and cloud collaboration channels for phishing, malware, and social engineering attacks.

Endpoint Security & Management

- Agger Labs: Focuses on host-level protection against ransomware and process tampering.

- Acronis: Merges endpoint data backup with cyber protection to secure local and cloud-based data assets.

- Fleet: Uses Osquery to maintain real-time visibility over device fleets, software inventories, and host states.

Identity & Access Management (PAM / EPM)

- Admin By Request: Removes permanent local admin rights, allowing users to request time-limited, audited privilege elevation.

Security Service Edge (SSE) & Zero Trust

- Netskope: Controls access to SaaS applications and internal network resources using Cloud Access Security Broker (CASB), Zero Trust Network Architecture (ZTNA), and web security policies.

Deception & Intrusion Detection

- Tracebit: Uses decoy cloud infrastructure to catch unauthorized lateral movement and adversary probing with high-confidence alerts.

Vulnerability & Exposure Management

- Tenable Nessus (Attack Simulation): Scans infrastructure to surface active vulnerabilities and simulate threat vectors across the attack surface.

IT Operations & Service Management (ITSM)

- Freshservice: Streamlines service requests, IT asset tracking, and automated incident creation based on security alerts.

Learn more about all available integrations and how to connect your security stack.

Product updates

We are constantly implementing updates and new features to the Wirespeed platform.

Over the last quarter, we revisited our security information and event management (SIEM) architecture — one of the foundations of Wirespeed. We updated it to prepare for the future and give your security team more autonomy. In addition, we’re putting more data directly in your hands so you can prove Wirespeed’s ROI with ease.

Enhanced SIEM Architecture

We have enhanced Wirespeed’s SIEM platform to improve overall user experience. Logs are now stored in their native format rather than the previous Open Cybersecurity Schema Framework (OCSF).

How does this directly improve your Wirespeed experience?

- Speed: You can query logs 80-100 times faster than before.

- Ease: Logs are now organized by source, enabling Wirespeed AI to better identify the root cause behind an incident.

- Proactive: An updated SIEM allows for further automated verdicts informed by Coalition-native threat intelligence.

Managed Detections

Managed Detections work on top of existing third-party integrations to help catch evasive threats that traditional security tools can overlook.

Managed Detections are powered by insights from over 1 billion daily events, data from security scans and incidents across the globe, and threat intelligence provided by Coalition Incident Response (CIR)*. In addition to traditional signs of malicious activity, such as suspicious logins or unlikely travel, Wirespeed monitors for novel or unconventional indicators of attack directly informed by real-life scenarios.

For example, following the rise of device code phishing, which abuses the OAuth 2.0 Device Authentication functionality, Wirespeed began to monitor for successful device-code authentication followed by multiple logins for the same user. Whereas traditional tools can miss the abuse of Microsoft’s OAuth feature because the logins look legitimate, Wirespeed recognizes it as suspicious behavior and can act automatically to contain attackers.

We are constantly expanding our library of Managed Detections. The team continues to track the latest threat intelligence data to parse into automated rules that function across all client environments.

User Identity Patterns

You can now use Wirespeed’s activity baseline data in your own investigations.

Wirespeed tracks what “normal” behavior is for your users across multiple sources, such as where they work from, when they work, and which devices they use. This activity informs their predictable, baseline activity. This information is how Wirespeed knows to act when users stray from their usual behavior patterns, like unlikely travel.

We recognize that this information can be useful for your team to complete its own investigations as well, especially if Wirespeed augments your security capabilities. To access individual user baseline data, go to Users and select an individual to see Day & Time Login Patterns, User Agents, Logins by Browser, and more.

Impact & ROI Widget

One of the biggest challenges that security leaders face is translating technical defense into business terms. How do you prove to decision-makers that the tools you have (or need) move the needle on risk reduction?

You should always know exactly how Wirespeed delivers for you and your team, and clearly be able to show that value to others. Along with the new visibility of User Identity Patterns, where you can see our work, we also have an Impact & ROI Widget designed to highlight how Wirespeed’s automation-fueled noise reduction saves time and labor costs.

You can toggle seamlessly between Time Saved (hours) and Financial Value (dollars) across rolling 90-day windows. Estimates are informed by SOC industry standards of the average hourly cost of analyst labor ($50) with the average manual triage time (20-minutes). The operational impact is informed by personalized Wirespeed data for your organization, by subtracting the analyst time spent on escalated reviews from total automated triage hours and cost.

You can find the Impact & ROI Widget, along with other high-level statistics, in Team Analytics.

We’re here to enhance your team

Wirespeed is always improving to adapt to new threats, meet the needs of different security teams, and provide the best possible protection.

While you focus on the bigger picture, we monitor user behavior, track threat intelligence feeds, and implement new features to make your investigations go smoother.

MILLISECONDS-FAST. DETERMINISTIC-FIRST.

Wirespeed AI SOC

See how Wirespeed stops threats in milliseconds >