The ZWatch platform
One on-premises console that audits your security devices, explains every event in plain language and links related events into incidents.
| Severity | Finding | Source | Owner |
|---|---|---|---|
| Critical | VPN login linked to malware on FIN-PC-12 | VPN + Endpoint | Security team |
| High | 412 blocked remote desktop attempts from one address | Firewall | Network team |
| Medium | Rule 27 allows any traffic and is unused for 90 days | Firewall | Firewall admin |
| Medium | Port 7 half duplex with 1,840 CRC errors | Switch | Network team |
| Rule | From / to | Service | Action | Assessment |
|---|---|---|---|---|
| 12 | LAN to Servers | HTTPS | Allow | Healthy |
| 27 | Any to Any | All | Allow | Any-to-any, unused 90 days |
| 31 | Guest to LAN | All | Allow | Overly broad service |
| 44 | Branch to DMZ | SSH | Allow | Shadowed by rule 12 |
| 58 | VPN users to ERP | HTTPS | Allow | Healthy |
| Recommendation | Impact | Status |
|---|---|---|
| Turn on exploit prevention for all workstations | High | To do |
| Scan removable drives when connected | Medium | Applied |
| Block untrusted scripts on servers | High | To do |
| Update 31 agents running an old version | Medium | Overdue |
- HighLoop detected on VLAN 20 between SW-ACC-04 and SW-ACC-07
- MediumPort 7 at half duplex with 1,840 CRC errors: faulty cable or network card
- MediumUplink to the server room reaches 92% every morning: bottleneck
- HighPhishing from a lookalike of your own domain was quarantined for 23 users
- MediumMail to one partner has been delayed for 2 hours: their server refuses TLS
- 03:12Login for j.doe from an unusual country, outside working hoursVPNInitial access
- 03:15Internal scan of 64 hosts from the VPN addressFirewallDiscovery
- 03:18Trojan detected and quarantined on FIN-PC-12Endpoint securityExecution
- 03:19Callback to a known malicious server blockedFirewallCommand and control
| Control | Requirement | Coverage | |
|---|---|---|---|
| CIS 4.4 | Firewall rules restricted to needed services | 72% | |
| ISO/IEC 27001 A.8.20 | Network security controls | 81% | |
| NIST CSF PR.AA | Access is limited and reviewed | 88% | |
| CIS 8.2 | Audit logs collected and kept | 100% |
Everything your security team needs, in one place.
Configuration audit
Finds risky, unused, shadowed and overlapping rules, and builds a clean-up plan you can run step by step.
Logs in plain language
Every log line becomes clear fields and a readable sentence. Raw lines are kept for evidence exports.
Attack correlation
Links events across firewalls, VPN, endpoints and email into multi-stage incidents mapped to MITRE ATT&CK.
Offline threat intelligence
Curated threat feeds ship with every update and combine with the verdicts already in your device logs.
Behaviour analytics
Learns normal behaviour for users and hosts and flags logins, traffic and access that do not fit.
Incident cases
Turns findings into cases with an owner, status, timeline and a full audit trail.
Reachability and what-if
Answers whether A can reach B across linked sites, VPN and SD-WAN, with the exact changes needed.
Health monitoring
Watches gateways, switches, Wi‑Fi and endpoint security servers using their own logs.
Compliance and evidence
Maps findings to CIS Controls, ISO/IEC 27001 and NIST CSF, with evidence exports for auditors.
How data flows into ZWatch.
Devices send logs and configuration backups. ZWatch analyses them on your own appliance and gives your team results, never the other way round.
Deploy it your way.
Virtual appliance
A ready-to-run appliance that prepares its database and encryption on first start, then opens the dashboard.
Your own server
Install on a server you already manage, with a local database or one you already run.
No internet needed
Updates, including threat intelligence, arrive as packages you install yourself.
See ZWatch on your own network.
Ask for a trial licence and we will help you connect your first devices.