Devo Security Data Platform

What it does

The Devo Security Data Platform is a cloud-native Security Information and Event Management (SIEM) platform with built-in Security Orchestration, Automation and Response (SOAR) and User and Entity Behavior Analytics (UEBA). It runs on HyperStream, a streaming data architecture that ingests events in their original form without indexing or normalizing them at ingest. All ingested data stays hot and searchable for up to 400 days with sub-second query response, rather than being tiered into cold storage that must be rehydrated before search.

How it works

Data load balancers spread ingested events across data nodes that classify, compress, and store them. Meta nodes parallelize queries and enrich data at query time. Data orchestration filters and routes lower-value data to destinations such as Amazon S3, Databricks, and Snowflake. Real-time streaming alerts feed ThreatLink, which triages, correlates, and enriches them into prioritized cases. DeepTrace runs autonomous investigations and threat hunts mapped to MITRE ATT&CK. Devo Behavior Analytics rescores users, devices, and domains hourly from dozens of behavior models. Collective Defense applies community threat intelligence to surface emerging attacker techniques. Customers include Bitkub Exchange, CarGurus, OneMain Financial, and Omnicom.

Credentials and traction

The Devo Security Data Platform holds SOC 2 Type II and SOC 3 attestations. The platform earned a Visionary placement in the 2024 Gartner Magic Quadrant for Security Information and Event Management (SIEM), its second consecutive inclusion. It was named a Leader in the 2024 IDC MarketScape Worldwide SIEM for Enterprise and a Leader and Fast Mover in the 2024 GigaOm Radars for SIEM and Autonomous Security Operations Center Solutions. It serves Fortune 500 enterprises and managed security service providers.