Threat Detection and Response (XDR)
PONIVA XDR is a Turkish-made SIEM + XDR platform that brings endpoint, network and log data together in one place. It correlates events from your firewalls, servers, computers and NAS devices, exposes attacks before they cause damage and lets you respond from a single console. It ships as a closed appliance that runs inside your organization; your data never leaves your premises.
- ~400ready-made correlation rules, mapped to MITRE ATT&CK
- 20+vendors with out-of-the-box log support
- 4 platformsendpoint agent for Windows, Linux, FreeBSD and Synology NAS
- 50+remote response actions on endpoints
Fragmented visibility, delayed detection
When security products work in isolation, each sees only a fragment. A suspicious process on an endpoint, an unusual network connection and failed logins in the logs may mean little on their own.
Advanced attacks advance in exactly that gap. Without a layer that correlates events, the attack is noticed only after the damage is done.
SIEM, XDR and SOAR in one platform
Centralized visibility (SIEM)
- Centralized log collection via syslog (UDP/TCP/TLS) and agents
- Ready-made parsers for Fortinet, Palo Alto, Cisco, Check Point, SonicWall, Sophos, F5, A10, MikroTik, Ruijie, pfSense, Synology, Windows, Linux and any source in CEF format
- Live log monitoring, advanced search and saved queries
- Device inventory, network topology, geographic traffic map, VPN and RDP session monitoring
Smart detection
- Correlation engine: threshold, event-sequence and distinct-count rules; combines multi-step attacks such as brute force followed by a successful login, lateral movement and data exfiltration into a single incident.
- Up-to-date threat rules: ransomware, credential theft (Kerberoasting, DCSync, NTDS.dit dumping), abuse of remote management tools (AnyDesk, ScreenConnect, etc.), attempts to disable security software with vulnerable drivers, and exploitation of edge-device vulnerabilities such as FortiOS, SharePoint, Citrix, Check Point, PAN-OS and Ivanti.
- Sigma and YARA support: import community rules or write your own.
- Behavior analytics (UEBA): per-user and per-device behavior profiles; alerts on anomalies such as unusual hours, impossible travel, or a country or process seen for the first time.
- Risk scoring: asset and user risk scores, attack chain visualization.
- Deception accounts: decoy user and service accounts that raise an alarm the moment an attacker touches them.
Threat intelligence
- The USOM malicious link list and international sources (Spamhaus, Emerging Threats, Tor exit nodes, CINS, URLhaus) are updated automatically.
- Every incoming log is matched against malicious IP and domain lists.
- Vulnerability management: software on devices is matched against CVEs and Microsoft security bulletins; patch rings enable controlled updates.
Endpoint protection (EDR)
- Process monitoring: process trees and suspicious command chains
- File integrity (FIM): changes to critical system files and application data
- Ransomware: detection of mass encryption and extension changes; catching attempts to delete shadow copies
- Post-ransomware rollback: affected files are restored from a previously taken VSS snapshot
- SQL Server "silent ransom" detection: an attacker enabling TDE encryption with their own key
- Security posture: regressions in Defender, firewall and encryption settings
- Active Directory hygiene: detection of risky accounts and configurations
Data loss prevention (DLP)
- USB device control: full blocking or read-only use
- Detection of Turkish ID numbers, IBANs and credit card numbers copied to the clipboard
- Tracking of sensitive file movements and bulk or after-hours printing
- Detection of remote access tools (AnyDesk, TeamViewer, etc.) and policy-based blocking
Response and automation (SOAR)
- One-click response: isolate the device from the network, kill a process, block an IP, log the user off, lock USB, lock the device
- Playbooks: automatic actions when a rule fires; an approval step can be defined for critical servers so automation does not disrupt business
- Notification and incident management integrations: email, Slack, Microsoft Teams, Telegram, Jira, ServiceNow, PagerDuty
- Incident lifecycle: assignment, notes, evidence snapshots, SOC metrics (time to detect and time to close)
OT/ICS and email security
- Monitoring of industrial protocol access (PLC engineering connections, segment violations, after-hours access)
- Detection of malicious attachments, phishing and account takeover from email gateway logs
Regulatory compliance
- Law No. 5651: logs are signed with a SHA-256 hash chain and can optionally be timestamped (TSA). Provides tamper-evident log retention and evidence packages for official requests.
- KVKK, ISO 27001 and PCI-DSS compliance reports
- Retention policies; automatic, controlled archive management before the disk fills up
- Audit trail for administrator actions
Deployment and security
- Closed appliance (virtual machine image, VMware OVA): web interface only, in Turkish, single console
- Runs entirely on-premises; data stays in Türkiye and inside your organization
- Role-based access control and two-factor authentication (MFA)
- Signed update packages; agents update automatically via signed packages
- Per-appliance licensing
Threat Detection and Response (XDR) — frequently asked questions
What is the difference between XDR and EDR?
EDR only monitors endpoint (computer, server) data. XDR adds network traffic and log data on top and correlates them all, so a symptom seen on a single computer can be detected as part of a network-wide attack.
How does PONIVA XDR work with PONIVA Firewall?
PONIVA Firewall sends its logs to PONIVA XDR via syslog. The correlation engine combines these logs with events from agents on servers, computers and NAS devices into a single incident. Once a threat is confirmed, responses such as isolating the device from the network or blocking an IP are carried out from the same console.
Can a small IT team manage PONIVA XDR?
Yes. Thanks to automatic event correlation and predefined response rules, organizations without a 24/7 SOC team can also run the platform.
Is PONIVA XDR a Turkish product?
Yes. It is developed in Türkiye by PONA Teknoloji; data is kept within the country.
Which devices can it collect logs from?
It collects logs from any device that can send syslog. Ready-made parsers are available for common firewall, network and server brands, and the CEF format is supported in general.
Does it store logs in compliance with Law No. 5651?
Yes. Logs are signed with a hash chain and can be timestamped, so you can prove they have not been altered.
What does it do during a ransomware attack?
It detects mass encryption and the preparatory steps (deleting shadow copies, stopping backup services), can isolate the device and can restore files from a VSS snapshot.
Which operating systems does the agent run on?
Windows, Linux, FreeBSD and Synology NAS.
Can automated response cause business disruption?
Responses are governed by policy. An approval step can be defined for critical servers, so automation does not interrupt your own services.
Secure your network with
technology you can trust.
Let us find the right solution for your organisation together. Get in touch with our specialists.