ARX Sentry: continuous monitoring and real-time alerts, the sentinel always on guard

Cyber threats move fast and quietly: spotting them right away makes the difference between a simple alert and an incident. ARX Sentry is the ARXDOME monitoring module: it collects what happens on computers, servers and firewalls and brings it, already enriched, to the SOC and NOC pages.

How it works

On Windows, Linux and macOS computers and servers you install the ARXDOME agent, with a single command and a company-specific code. It collects logs and security events, the inventory of hardware, system, software, processes and ports, file integrity monitoring on the chosen folders and configuration assessment.

Firewalls and other network devices send their logs to a central collector, with a dedicated port for each customer: the source address stays the real one, the traffic travels through an encrypted tunnel and every line is tagged with the customer’s identity before analysis. Devices register automatically.

In the pipeline every event is normalized and enriched with country, provider, threat lists and organization, and grouped into families: failed logons, use of explicit credentials, suspicious executions, persistence, account changes, matches with threat intelligence.

ARX Sentry: more than an alarm

The SOC pages, for our operators and for you, show overview, machines and devices, software, events, threat landscape, MITRE ATT&CK tactics and identities: logons, failures, bursts of attempts, privileged logons, remote desktop, night-time logons, account changes.

The live NOC map draws the customers’ perimeter on the globe as events arrive: connections denied by the firewall, sources found in threat lists, VPN errors, blocked outbound traffic. It can be projected full screen.

For firewalls there are dedicated pages, built around the device model, with contracts and expiry dates, policies, local network devices and firmware status, in read-only mode.

What it offers: ARX Sentry

Agent for Windows, Linux and macOS, installed with one command and a code
Log collection from firewalls and network devices, with a dedicated port per customer
SOC pages: overview, machines, software, events, threats, MITRE ATT&CK, identities
Live NOC map, also full screen
Dedicated firewall pages, read-only
Protection status of every machine