ManageEngine announced a new API that enables third-party tools to access log data generated by EventLog Analyzer, its security information and event management (SIEM) solution.

Available immediately, the EventLog Analyzer API lets security administrators feed reams of normalized log data into any third-party application, including crowd-sourced threat intelligence solutions, vulnerability assessment platforms, business intelligence tools or even custom applications for advanced security intelligence and threat protection.

Though SIEM solutions have been offering provisions to import data from varied sources, such integrations are fraught with many limitations. In the absence of proper correlation and data processing, feeding terabytes of data to the SIEM solution will not offer the required protection. EventLog Analyzer shatters all these limitations by opening up its database for integration with any third-party application.

Security administrators can leverage this integration to bolster their security framework in such use cases as:

- Advanced threat mitigation – The normalized data from EventLog Analyzer could be fed into crowd-sourced advanced threat intelligence services, sandbox solutions or sophisticated vulnerability assessment platforms. These tools can associate EventLog Analyzer’s security data with the information they already possess and help mitigate emerging attacks, botnets, zero-day threats, phishing attacks, malware attacks and advanced persistent threats (APT).

- Location-based threat analysis – Integration with geolocation services could help enterprises gain geographic context to any event. This, in turn, helps pinpoint the country of origin and physical location of an application involved in an event. If the origin matches the countries commonly associated with APTs, suspicious traffic could be isolated for deeper analysis.

- Customized security views – Security managers could even create their own web applications and dashboards by extracting the data critical to their needs.

- Application performance tuning – Normalized data from EventLog Analyzer could be fed into modern business intelligence tools, which could help organizations understand the evolving threat landscape, assess risks and prepare mitigation strategy and an emergency response plan in the event of attack. The data could also help drill down to overall application performance issues and assess product usability and quality.

EventLog Analyzer provides Thrift IDL-based APIs which security administrators can use to pull all required data and achieve integration. The power of the API has been demonstrated through a Python-based client as the reference implementation.

EventLog Analyzer collects, normalizes, analyzes, correlates and stores voluminous logs from heterogeneous sources. Now, the API can provide actionable intelligence and help security admins trace, thwart and combat evolving threats.

The API is available immediately and works with EventLog Analyzer v 9.0. Users can submit a request to access the API, and the EventLog Analyzer technical support team will get in touch with them.