Data Model

Secure60 is built on a data model that allows sophisticated threat detection and flexible data analysis whilst presenting users with a clean and simple experience that focuses on what matters most - resolving Threats.

There are 3 main data components that make up the structure of the system:

• Events: These are raw items formatted according to the Secure60 schema
• Signals: These are items that are interesting from a security perspective (For example a login process is interesting whether its success or failure)
• Threats: These are items that are created by looking at Events and Signals where we have identified a security issue that needs to be addressed

See Common Information Model for a deeper look at the Event object schema.

The data model visualised: