The software

AarView

The security orchestrator that installs above your SIEM.

AarView is software published by CyberAar and sold under licence. You install it on your own server, with its identity provider, and it orchestrates the security operations you already run. It does not replace your SIEM: it reads it.

Read the documentation Request the distribution →

Who it is for

You run your own SOC

Your analysts keep their SIEM and their rules. AarView brings their alerts together, turns them into cases, automates under approval and produces the reports.

You serve several organisations

One instance can serve several clients. Each account belongs to a client, and the database enforces that isolation row by row. An analyst sees only the clients assigned to them.

You are an AarSOC client

CyberAar's managed SOC runs on AarView: you follow the service there, with nothing to install.

Discover AarSOC →

How it plugs in

AarView does not collect your logs and ships no detection engine. Detection stays in your SIEM; AarView receives its alerts in their native format and sends its decisions on to your tools.

Your sources

  • Wazuh
  • Elastic Security
  • OpenSearch Security Analytics
  • Splunk
  • IBM QRadar
  • Microsoft Sentinel
  • Graylog
  • Generic JSON

Push (the SIEM sends) or pull (AarView reads), depending on the product. A generic JSON format for any other tool.

AarView

  • ✓ Incidents and cases
  • ✓ SOAR with approval
  • ✓ PDF reports
  • ✓ Intelligence
  • ✓ Isolation per client

Your tools

  • Slack
  • Microsoft Teams
  • Jira
  • ServiceNow
  • Signed HTTPS webhook

Every send waits for an administrator's decision. Only the case title, severity, reference and link, the client and rule names, the ATT&CK techniques and the time leave AarView.

AarView also reads Cortex (observable analysis) and, with a compatible engine, a threat intelligence platform (indicator sharing) and a forensic collection tool (collection on a host). Compatibility list on request.

What it does

Incidents and cases

  • ● One queue for every source and the API
  • ● Alerts grouped into a case
  • ● Mandatory reason to close
  • ● MITRE ATT&CK coverage of the scope

Native SOAR

  • ● Rules tested on the last 7 days before enabling
  • ● Visual editor and playbooks
  • ● No isolate, kill or block action
  • ● Collection on a host under approval

Reports

  • ● Per incident, per machine and monthly
  • ● PDF, password protected
  • ● In French or English
  • ● An unreadable source is flagged, not hidden

Intelligence

  • ● Indicator watchlist
  • ● Searched across 90 days, then every hour
  • ● Observable analysis with Cortex
  • ● News from the official CERTs

Estate monitoring

  • ● Machines, ports, accounts, vulnerabilities
  • ● Actively exploited flaws first
  • ● Hardening posture, machine by machine
  • ● Collection health, never "all good" by default

AI assistant, optional

  • ● Needs a connected AI service
  • ● Its proposals are suggestions
  • ● An analyst decides
  • ● A proposed rule goes through the same validation

The estate monitoring pages rely on a compatible event store and endpoint manager (list on request). All features →

Editions

Standalone edition

On one Linux server with Docker. One script, install.sh, generates the secrets and the certificate, starts the stack and configures the identity provider. At least 2 vCPU and 6 GB of memory, 20 GB of disk, and only port 443 open inbound.

Installation →

Licence bound to the instance

A key signed by CyberAar, valid for one installation only. It sets the seats, the modules and the limits (clients, sources). Alert intake is never blocked by the licence, even an expired one.

Licence →

Orchestrator edition

For organisations that run their own SOC: every AarView tool, per the modules purchased, at the service of your analysts, with no service commitment from CyberAar. Your offers and your promises to your clients remain your own.

Hand over to AarSOC

In the Orchestrator edition, a super administrator can hand a precise scope (nights and weekends, a site, a subsidiary, everything) to the AarSOC managed SOC, without changing tools. AarView prepares the request and you send it yourself: the instance never contacts CyberAar.

Security and sovereignty

  • ✓ Two-factor authentication mandatory for everyone, from the first sign-in
  • ✓ Lockout after 5 failures, passwords of at least 12 characters
  • ✓ Session closed after 30 minutes of inactivity, 8 hours at most, tokens revoked on sign-out
  • ✓ Isolation per client enforced in the database (row-level security)
  • ✓ The portal never holds the identity provider's admin token: a limited directory account, proven by 28 checks
  • ✓ One published port (443), TLS 1.2 or later, strict SNI
  • ✓ Source and webhook secrets encrypted, audit log of actions
  • ✓ Outbound flows to public sources carry none of your data, and can be switched off on a closed network
  • ✓ Interface, reports and e-mails in French and English

The security model →

Install AarView, or hand over the monitoring

To obtain the distribution and a licence, write to us. If you would rather have the CyberAar team monitor your estate for you, that is the AarSOC managed SOC.

Request the distribution Read the documentation → The AarSOC managed SOC →