Positive Technologies has released MaxPatrol SIEM 28.0, offering SOC teams the ability to extract more value from existing servers. According to the vendor’s internal tests, the updated system consumes up to 26% less CPU resources and up to 52% less RAM than the previous version, potentially allowing organizations to postpone hardware purchases.
Developers focused on optimizing the components responsible for security event processing and data storage. In the example provided by the company, the version 27.6 component processed 20,000 events per second, while the updated version handles 40,000 events per second on comparable hardware resources.
The architecture has also been revised. When MaxPatrol SIEM operates separately from other platform products such as MaxPatrol VM, unnecessary roles can be excluded during installation, freeing additional resources by reducing the number of installed components.
The behavioral analysis module MaxPatrol BAD received a significant update. The new HackTracker component detects attackers based on behavioral patterns rather than solely on the tools they use. The module now analyzes events from Unix nodes and links them into chains of suspicious activity.
Configuration of the AI assistant PT Naira has been simplified. The assistant helps write normalization rules, explains events, and searches documentation. The developer states that the assistant can reduce investigation time by up to 50% and the effort required to create rules by up to 90%. Updates to the assistant will be released independently of SIEM version releases.
Analysts received additional context in the cards of standard correlation rules, quick navigation to relevant sections, and a native dark theme that does not affect server load but improves usability during night shifts.
Version 28.0 is already available for independent installation. The main focus of the release remains increasing processing capacity without mandatory acquisition of new servers.
