> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/appendix/feature-scope-of-the-enginsight-platform.md).

# Feature Scope of the Enginsight Platform

Here you will find an overview of the features of the Enginsight platform, including the Enginsight SIEM.

## Cross-Platform Features

<table><thead><tr><th width="299.5625">Feature</th><th>Details</th></tr></thead><tbody><tr><td>Web user interface</td><td><ul><li>Cross-platform compatibility (Linux, Windows, macOS)</li><li>Access and operate the platform via a browser</li></ul></td></tr><tr><td><a href="/docs/manual/english/administration/settings/multi-factor-authentication.md">Two-factor authentication (2FA)</a></td><td><ul><li>2FA via email, SMS, or authenticator app</li><li>For individual users or all team members</li></ul></td></tr><tr><td>Single sign-on (SSO)</td><td><ul><li><a href="https://docs.enginsight.com/docs/knowledge-base/english/miscellaneous/how-do-i-set-up-single-sign-on-sso-via-microsoft-365-in-enginsight">SSO via Microsoft 365</a></li></ul></td></tr><tr><td>Multi-tenancy</td><td><ul><li>Management via <a href="/docs/manual/english/administration/organization-management.md">main organizations and suborganizations</a></li><li>Unlimited number of suborganizations for main organizations</li><li><a href="/docs/manual/english/administration/settings/contingent-management.md">License contingent management</a></li><li><a href="/docs/manual/english/platform-usage/dashboard/operation-centers/asset-operation-center.md">Asset Operation Center</a></li><li><a href="/docs/manual/english/platform-usage/dashboard/operation-centers/partner-operation-center.md">Partner Operation Center</a></li></ul></td></tr><tr><td><a href="https://docs.enginsight.com/docs/knowledge-base/english/miscellaneous/what-white-labeling-options-does-enginsight-offer-for-its-platform">White labeling</a></td><td><ul><li>White labeling of the platform for main organizations</li></ul></td></tr><tr><td><a href="/docs/manual/english/administration/permission-management.md">Permission management</a></td><td><ul><li>Role-based view and access management</li><li>Custom roles</li></ul></td></tr><tr><td>User management</td><td><ul><li>Unlimited number of users (<a href="/docs/manual/english/administration/settings/team-members.md">team members</a>)</li><li><a href="/docs/manual/english/administration/settings/groups.md">User groups</a></li><li>Logging of <a href="https://docs.enginsight.com/docs/knowledge-base/english/logging/which-activities-are-recorded-in-the-enginsight-user-log">user activities</a></li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/alerts-beta.md">Alerting</a></td><td><ul><li>Preconfigured <a href="https://docs.enginsight.com/docs/knowledge-base/english/alerting/which-specific-alerts-can-i-define-in-enginsight">alerting conditions and scenarios</a></li><li>Alert notifications via email, <a href="https://docs.enginsight.com/docs/knowledge-base/english/alerting/how-do-i-configure-sms-notifications-for-alerts-in-enginsight">SMS</a>, Microsoft Teams, Mattermost, and <a href="https://docs.enginsight.com/docs/knowledge-base/english/alerting/how-do-i-configure-alert-notifications-in-slack-in-enginsight">Slack</a>, as well as custom notifications via <a href="/docs/manual/english/platform-usage/alerts/webhooks.md">webhook</a></li><li><a href="/docs/manual/english/platform-usage/alerts-beta/notification-templates-beta.md">Notification templates</a></li><li>Automated execution of actions via custom scripts (<a href="/docs/manual/english/platform-usage/hosts/management/plugins.md">plugins</a>)</li></ul></td></tr><tr><td>Dashboards</td><td><ul><li>Preconfigured dashboards for standard features</li><li>Custom dashboards (<a href="/docs/manual/english/platform-usage/siem/cockpits.md">cockpits</a>) in the Enginsight SIEM</li></ul></td></tr><tr><td>Reports</td><td><ul><li>Reports in PDF, CSV, or DOCX format</li></ul></td></tr><tr><td>Import/export</td><td><ul><li>Import and export options for various configurations and objects</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/hosts/management/tag-manager.md">Tag management</a></td><td><ul><li>Central tag management and assignment</li><li>Custom tags</li></ul></td></tr><tr><td>IPv4/IPv6 support</td><td><ul><li>Support for monitoring and analyzing IPv4 and IPv6 networks</li></ul></td></tr></tbody></table>

***

## Vulnerability Management

Detection and analysis in vulnerability management are performed on [hosts](/docs/manual/english/platform-usage/hosts.md) (servers and clients) by the Enginsight agent Pulsar and for [endpoints](/docs/manual/english/platform-usage/endpoints.md) (websites and domains) by the Enginsight component [Observer](/docs/manual/english/platform-usage/endpoints/required-services/observer.md).

<table><thead><tr><th width="299.8359375">Feature</th><th>Details</th></tr></thead><tbody><tr><td>Detection of Common Vulnerabilities and Exposures (CVE)</td><td><ul><li>For hosts and endpoints</li><li>CVE white-box, grey-box, and black-box network scan</li><li><a href="https://cve.enginsight.com/">Proprietary CVE database</a>, enriched with data from CVE Numbering Authorities (CNA) and Authorized Data Publishers (ADP)</li></ul></td></tr><tr><td>Vulnerability assessment using different scoring systems</td><td><ul><li>Assessment according to the Common Vulnerability Scoring System (CVSS) v3.1</li><li>Assessment according to the Exploit Prediction Scoring System (EPSS)</li><li>Assessment according to the Environmental Score (ENVS)</li></ul></td></tr><tr><td>Environmental Score Management</td><td><ul><li><a href="/docs/manual/english/platform-usage/hosts/vulnerability-management/environmental-score-manager.md">Environmental Score Manager</a> for hosts and endpoints</li><li>Vulnerability management and risk analysis tailored to your own infrastructure</li><li>Assessment based on specific Environmental Score Metrics (vectors)</li></ul></td></tr><tr><td>Recommended actions for remediating vulnerabilities</td><td><ul><li>Warnings from the German Federal Office for Information Security (BSI) for detected CVEs</li><li>Recommendations for mitigations</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/hosts/management/software-inventory.md">Software inventory</a></td><td><ul><li>Detection of installed software on hosts</li><li>Information about version, vendor, and source</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/hosts/vulnerability-management/update-manager.md">Update management</a></td><td><ul><li>Overview and installation of missing software updates on hosts</li><li>For Windows: System updates and updates via Windows Server Update Services (WSUS)</li><li>For Linux: Updates via the Package Manager</li><li>For macOS: System updates and updates via Homebrew</li><li><a href="/docs/manual/english/platform-usage/hosts/vulnerability-management/update-history.md">Update history</a></li></ul></td></tr></tbody></table>

***

## Intrusion Detection and Prevention

Intrusion Detection and Prevention is performed on [hosts](/docs/manual/english/platform-usage/hosts.md) by the Enginsight agent Pulsar.

<table><thead><tr><th width="264.3203125">Feature</th><th>Details</th></tr></thead><tbody><tr><td>Detection of network attacks (<a href="/docs/manual/english/platform-usage/hosts/intrusion-detection-system.md">Intrusion Detection System</a>)</td><td><ul><li><a href="/docs/manual/english/platform-usage/hosts/intrusion-detection-system/network-anomalies.md">Analysis of system and network activities</a> using predefined rules, primarily so-called Snort Community Rules</li><li>Tiered detection system depending on protection requirements</li><li><a href="/docs/manual/english/platform-usage/hosts/intrusion-detection-system/world-map.md">Interactive live visualization</a> of network attacks</li></ul></td></tr><tr><td>Detection of <a href="/docs/manual/english/platform-usage/hosts/advanced-persistent-threats.md">Advanced Persistent Threats (APT)</a></td><td><ul><li>File-based analysis of APTs using predefined and custom <a href="/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/rules.md">YARA rules</a></li><li>Custom <a href="/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/plans.md">plans</a> for automated APT scans</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/hosts/tls-interception.md">TLS interception</a></td><td><ul><li>Hosts with Linux operating systems</li><li>Decryption and analysis of encrypted network traffic directly on the host</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/hosts/tracer.md">Machine learning-based time-series analysis</a></td><td><ul><li>Host-based monitoring of specific metrics</li><li>Machine learning: creation and training of AI models that automatically detect deviations from a calculated normal state</li></ul></td></tr><tr><td>Blocking of network attacks (<a href="/docs/manual/english/platform-usage/shield.md">Intrusion Prevention System / Shield</a>)</td><td><ul><li>Tiered blocking system depending on protection requirements</li><li><a href="/docs/manual/english/platform-usage/shield/manual-blocking.md">Manual rules</a> for blocking specific connections on specific hosts</li><li>Automatic rules (<a href="/docs/manual/english/platform-usage/shield/dynamic-blocking/autopilot.md">Autopilots</a>) for dynamically blocking detected network attacks</li><li><a href="/docs/manual/english/platform-usage/shield/logs.md">Logging</a> of blocked connections</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/shield/microsegmentation.md">Microsegmentation</a></td><td><ul><li>Isolation of individual hosts or host groups</li><li>Allowing specific connections explicitly</li><li>Management of network traffic between individual hosts or host groups according to the zero-trust principle</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/hosts/intrusion-detection-system/whitelist.md">Whitelisting</a></td><td><ul><li>For dedicated IP addresses and subnets</li><li>For <a href="/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/whitelist.md">detected APTs</a></li><li>Exclusion of false-positive detections</li></ul></td></tr></tbody></table>

***

## Website Security

[Endpoints](/docs/manual/english/platform-usage/endpoints.md) (websites and domains) are checked by the Enginsight component [Observer](/docs/manual/english/platform-usage/endpoints/required-services/observer.md).

<table><thead><tr><th width="299.73046875">Feature</th><th>Details</th></tr></thead><tbody><tr><td>Ping monitoring</td><td><ul><li>Checking the availability and response times of endpoints</li></ul></td></tr><tr><td><a href="https://docs.enginsight.com/docs/knowledge-base/english/observer/which-ports-does-the-enginsight-observer-check-by-default">Port monitoring</a></td><td><ul><li>Checking for open ports</li></ul></td></tr><tr><td><a href="https://docs.enginsight.com/docs/knowledge-base/english/observer/welche-dns-validierungstests-fuhrt-der-enginsight-observer-durch">DNS validation</a></td><td><ul><li>Checking whether security-relevant DNS records exist</li></ul></td></tr><tr><td><a href="https://docs.enginsight.com/docs/knowledge-base/english/observer/which-web-encryption-checks-does-the-enginsight-observer-perform">Web encryption checks</a></td><td><ul><li>Checking SSL/TLS encryption for misconfigurations and the use of outdated technologies</li><li>SSL/TLS validation according to BSI <a href="https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR03116/BSI-TR-03116-4.html">TR-03116-4</a></li></ul></td></tr><tr><td><a href="https://docs.enginsight.com/docs/knowledge-base/english/observer/which-http-headers-does-the-enginsight-observer-check">HTTP header checks</a></td><td><ul><li>Checking whether security-relevant HTTP headers exist and are correctly set</li><li>Recommendations for HTTP headers that are not set correctly</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/endpoints/management/certificate-manager.md">Certificate Manager</a></td><td><ul><li>Checking the validity and trustworthiness of SSL/TLS certificates in use</li></ul></td></tr></tbody></table>

***

## IT Monitoring

Agent-based network monitoring and File Integrity Monitoring (FIM) are performed on [hosts](/docs/manual/english/platform-usage/hosts.md) by the Enginsight agent Pulsar. Agentless network monitoring is performed by the Enginsight component [Watchdog](/docs/manual/english/platform-usage/observations/required-services/watchdogs.md).

<table><thead><tr><th width="299.73046875">Feature</th><th>Details</th></tr></thead><tbody><tr><td>Agent-based network monitoring (on hosts)</td><td><ul><li>Monitoring of <a href="/docs/manual/english/platform-usage/host-detail-view/monitoring/metrics.md">various metrics</a> such as memory usage (RAM and swap memory), CPU utilization, disk utilization, and disk performance</li><li>Monitoring of <a href="/docs/manual/english/platform-usage/host-detail-view/monitoring/custom-metrics.md">custom metrics</a></li><li>Monitoring of <a href="/docs/manual/english/platform-usage/host-detail-view/monitoring/software.md">installed software</a></li><li>Monitoring the <a href="/docs/manual/english/platform-usage/host-detail-view/monitoring/services.md">starting and stopping of services</a></li><li>Monitoring of <a href="/docs/manual/english/platform-usage/host-detail-view/monitoring/processes.md">running processes</a></li><li>Monitoring of <a href="/docs/manual/english/platform-usage/endpoint-detail-view/detailed-views/open-ports.md">open ports</a></li><li>Monitoring of <a href="/docs/manual/english/platform-usage/hosts/management/system-events.md">system events</a></li></ul></td></tr><tr><td>Agentless network monitoring</td><td><ul><li><a href="/docs/manual/english/platform-usage/observations/health-checks/ping-monitoring.md">Ping monitoring</a>: Availability and response times of endpoints and network devices</li><li><a href="/docs/manual/english/platform-usage/observations/health-checks/port-monitoring.md">Port monitoring</a>: Checking for open ports on endpoints and network devices</li><li><a href="/docs/manual/english/platform-usage/observations/snmp.md">SNMP monitoring</a>: Monitoring using <a href="/docs/manual/english/platform-usage/observations/snmp/custom-mibs.md">custom MIB files</a></li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/hosts/file-integrity-monitoring.md">File Integrity Monitoring (FIM)</a></td><td><ul><li>Monitoring and logging of access to files and directories on hosts</li><li>Monitoring based on file system events of the operating system</li><li>Creation of custom rules and use of preconfigured, managed rules</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/discoveries/inventory.md">Network inventory</a></td><td><ul><li>Footprinting of all network devices in defined subnets</li><li>Detection of newly added network devices</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/hosts/tracer.md">Machine learning-based time-series analysis</a></td><td><ul><li>Host-based monitoring of specific metrics</li><li>Machine learning: creation and training of <a href="/docs/manual/english/platform-usage/hosts/tracer/models.md">AI models</a> that automatically detect deviations from a calculated normal state</li></ul></td></tr><tr><td>System hardening (for hosts)</td><td><ul><li><a href="/docs/manual/english/platform-usage/hosts/compliance/automatic-system-hardening-audits.md">Automated execution</a> of security-relevant technical checks on hosts to meet compliance requirements</li><li>Based on custom or preconfigured, managed <a href="/docs/manual/english/platform-usage/hosts/compliance/automatic-system-hardening-checklists.md">checklists</a></li><li>Semi-automatic or automatic rollout of system hardening measures</li></ul></td></tr></tbody></table>

***

## Penetration Testing

[Penetration tests](/docs/manual/english/platform-usage/penetration-testing.md) are performed using the Enginsight component [Hacktor](/docs/manual/english/platform-usage/penetration-testing/required-services/hacktors.md).

{% hint style="info" %}
A separate license is required to use the Hacktor.
{% endhint %}

<table><thead><tr><th width="299.73046875">Feature</th><th>Details</th></tr></thead><tbody><tr><td>Precise definition of <a href="/docs/manual/english/platform-usage/penetration-testing/management/target-groups.md">target systems</a></td><td><ul><li>Network segments, including subnets inventoried by the Enginsight component <a href="/docs/manual/english/platform-usage/discoveries/required-services/watchdogs.md">Watchdog</a></li><li>Individual IP addresses</li><li><a href="/docs/manual/english/platform-usage/endpoints.md">Endpoints</a> (websites and domains)</li></ul></td></tr><tr><td>Footprinting</td><td><ul><li>Collection of information that could be exploited for an attack</li><li>Basic scans (open ports, HTTP headers)</li><li>Deep scan (web applications, operating systems, installed packages, remote control services, mDNS)</li></ul></td></tr><tr><td>CVE scan</td><td><ul><li>Network-based broad scan for known vulnerabilities (Common Vulnerabilities and Exposures; CVE)</li><li>CVE grey-box and black-box scan</li></ul></td></tr><tr><td>Service brute force</td><td><ul><li>Attempts to gain access to the target system by trying large numbers of passwords</li><li>Comprehensive <a href="https://docs.enginsight.com/docs/knowledge-base/english/penetration-tests/how-does-a-penetration-test-with-enginsight-work##id-3-service-brute-force">list of attacked services</a></li><li>Configuration of <a href="/docs/manual/english/platform-usage/penetration-testing/management/auth-providers.md">authentication providers</a> possible</li><li>Tests using service-specific default authentication credentials and predefined password lists</li><li>Custom password lists possible</li></ul></td></tr><tr><td>Service discovery</td><td><ul><li>Analysis of detected services for security-relevant configuration issues, including authentication, permission assignments, and encryption methods</li><li>Comprehensive <a href="https://docs.enginsight.com/docs/knowledge-base/english/penetration-tests/how-does-a-penetration-test-with-enginsight-work#id-4-service-discovery">list of preconfigured checks for various services</a></li></ul></td></tr><tr><td><a href="https://docs.enginsight.com/docs/knowledge-base/english/penetration-tests/how-can-i-use-custom-scripts-in-penetration-tests-with-enginsight">Custom scripts</a></td><td><ul><li>Custom scripts can be used to extend the checks performed by default</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/penetration-testing/audits.md">Audits</a></td><td><ul><li>Detailed analysis and preparation of audits</li><li>Recurring execution</li><li>Audit history and audit delta for comparing results</li></ul></td></tr></tbody></table>

***

## Security Information and Event Management (SIEM)

{% hint style="info" %}
A separate license is required to use the Enginsight SIEM.
{% endhint %}

<table><thead><tr><th width="299.73046875">Feature</th><th>Details</th></tr></thead><tbody><tr><td>Central <a href="/docs/manual/english/platform-usage/siem/data-lake.md">data lake</a></td><td><ul><li>Collection of comprehensive security information from various internal and external log sources</li><li>Log-based, field-based, and event-based filtering</li></ul></td></tr><tr><td>Dashboards (<a href="/docs/manual/english/platform-usage/siem/cockpits.md">cockpits</a>)</td><td><ul><li>Use of managed cockpits</li><li>Creation of custom cockpits using widgets</li></ul></td></tr><tr><td>Managed streams</td><td><ul><li>Creation of custom log filters and use of managed log filters (<a href="/docs/manual/english/platform-usage/siem/advanced-settings/streams.md">streams</a>)</li><li><a href="/docs/manual/english/platform-usage/siem/stream-catalogs.md">Managed stream catalogs</a> with several thousand ready-made and continuously updated streams</li><li>Automatic <a href="/docs/manual/english/platform-usage/siem/incidents.md">incident detection</a></li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/siem/workflows.md">Workflows</a></td><td><ul><li>Stream based</li><li>Definition of specific conditions and condition sequences that trigger an incident when they occur</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/siem/orchestration-soar-beta/playbooks.md">Playbooks</a></td><td><ul><li>Orchestration and automation of response processes for security-relevant events</li><li><a href="/docs/manual/english/platform-usage/siem/orchestration-soar-beta/playbooks/add-playbook.md">Drag-and-drop-based creation</a> using widgets</li><li>History of playbook runs (<a href="/docs/manual/english/platform-usage/siem/orchestration-soar-beta/flows.md">flows</a>)</li><li>Integration of <a href="/docs/manual/english/platform-usage/siem/orchestration-soar-beta/llm-providers.md">LLM providers</a> for AI-assisted analysis and decision management possible</li></ul></td></tr><tr><td>Log collectors</td><td><ul><li><a href="/docs/manual/english/platform-usage/siem/general-collectors/log-files.md">Log file collectors</a> on hosts (no Syslog)</li><li><a href="/docs/manual/english/platform-usage/siem/general-collectors/event-relays.md">Event relays</a>: Custom Syslog collectors; use of preconfigured extractors for logs from known vendors possible</li><li><a href="/docs/manual/english/platform-usage/siem/host-collectors.md">Host collectors</a>: Preconfigured, operating system-specific collectors for Windows, Linux, and macOS</li><li><a href="/docs/manual/english/platform-usage/siem/api-collectors.md">API collectors</a>: Preconfigured collectors for cloud applications from known vendors</li></ul></td></tr><tr><td>Extractors</td><td><ul><li>Creation of <a href="/docs/manual/english/platform-usage/siem/advanced-settings/extractors.md">custom extractors</a></li><li>Use of preconfigured extractors in the context of Syslog collectors</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/siem/tracer.md">Machine Learning-based time-series analysis</a></td><td><ul><li>Machine learning: creation and training of <a href="/docs/manual/english/platform-usage/siem/tracer/models.md">AI models</a> that automatically detect deviations from a calculated normal state</li></ul></td></tr><tr><td>Data masking (<a href="broken://pages/EX9fcsXiS44KNAwDCBRT">obfuscation</a>)</td><td><ul><li>Masking of field values in selected log fields</li></ul></td></tr><tr><td><a href="/docs/manual/english/platform-usage/siem/advanced-settings/identity-providers.md">Integration of directory services</a></td><td><ul><li>AD user and group information is made available to the SIEM for analysis and further processing</li><li>Integration of Active Directory (via LDAP) or Microsoft Entra ID (formerly Azure AD)</li><li>Blocking Azure AD users</li></ul></td></tr></tbody></table>

***