24/7 Threat Monitoring Across Your Entire Environment

What Monitoring Covers

Most SMBs have coverage gaps they don't know about. Antivirus on endpoints but nothing watching network traffic. M365 configured but nobody reviewing admin audit logs. ARIA closes those gaps across four surfaces.

Endpoints: Windows, Linux, macOS

The Wazuh agent runs on every device and server in scope. On Windows, Sysmon provides detailed process creation, network connection, registry change, and file creation events that give ARIA behavioral visibility — not just "something ran," but what it ran, what it connected to, and what it wrote to disk. Linux and macOS coverage includes syslog, auditd events, and file integrity monitoring.

• Process creation and parent-child relationships (T1059 scripting engine detection)
• Network connections by process — catches beaconing and C2 callbacks
• Registry changes — persistence mechanism detection (T1547)
• File writes to sensitive directories — credential dumping, staging for exfil
• Scheduled task and service creation — common persistence paths

Network: Firewall Logs and DNS

On Enterprise plans, ARIA ingests firewall logs and DNS query telemetry. Firewall logs reveal lateral movement, unexpected outbound connections, and policy violations. DNS telemetry catches domain generation algorithm (DGA) traffic and connections to newly registered domains — both strong indicators of command-and-control activity.

Email: Microsoft 365 and Google Workspace

Business email compromise (BEC) starts in the inbox. ARIA monitors Exchange Online and Google Workspace for mailbox rule creation (attacker covering tracks), suspicious OAuth grants, impossible travel (login from Phoenix then London 20 minutes later), admin privilege escalation, and DMARC/DKIM/SPF failures that indicate spoofing attempts.

Cloud Identity: Azure AD and Google Workspace

Identity is the new perimeter. ARIA monitors Azure Active Directory and Google Workspace admin events — account creation, permission changes, MFA disablement, federated identity changes — and correlates them with endpoint activity to catch credential-based attacks that pivot from cloud identity to on-premise resources.

MITRE ATT&CK Coverage

MITRE ATT&CK is the industry-standard framework for mapping adversary techniques to detection opportunities. Every ARIA detection rule is mapped to the technique it covers, giving you a measurable security posture: you can see exactly which parts of the kill chain you have visibility into.

ARIA's default ruleset covers techniques across the following tactic categories: Initial Access (T1566 phishing, T1190 exploit public-facing app), Execution (T1059 scripting, T1203 client-side exploit), Persistence (T1547 registry run keys, T1053 scheduled tasks), Privilege Escalation (T1055 process injection, T1068 exploit vulnerability), Defense Evasion (T1036 masquerading, T1070 indicator removal), Credential Access (T1003 credential dumping, T1110 brute force), Lateral Movement (T1021 remote services, T1075 pass-the-hash), and Exfiltration (T1041 exfil over C2 channel).

This is not a complete list — the ruleset is updated as new techniques emerge — but it illustrates why "MITRE ATT&CK coverage" is a meaningful metric, not a marketing claim.

File Integrity Monitoring

FIM tracks changes to specified files and directories and alerts when unauthorized modifications occur. For HIPAA compliance, FIM on audit log directories satisfies the audit control requirements under §164.312(b). For PCI-DSS, it's a direct requirement under Requirement 10.3 (log integrity protection) and 11.5 (file change detection).

In practice, FIM catches: web server script tampering (Magecart-style attacks start with a file write), unauthorized changes to authentication configurations, and backup deletion — one of the first things ransomware does before encryption starts.

Why Rule-Based Detection Alone Fails

Traditional signature-based detection has a fundamental problem: it only catches what it's seen before. Attackers using living-off-the-land (LOTL) techniques — leveraging PowerShell, WMI, certutil, and other legitimate Windows tools already installed on every machine — leave no signature to match. The tool is legitimate; the behavior is malicious.

ARIA's behavioral layer builds a baseline for what "normal" looks like in your environment and alerts on deviations: PowerShell being called by a Word macro (T1059.001), certutil downloading content from the internet (T1105), WMI spawning a command shell. These are the techniques that bypass antivirus and traditional IDS — and the ones most commonly used in ransomware and APT campaigns targeting SMBs.