Anexet forwards DLP and insider-threat security events to an external SIEM in real time, letting your SOC correlate endpoint data-leak signals with the rest of your security stack. Anexet is deployed on-premise; the vendor has no access to your data. Available on the Premium plan.
Schedule a Demo
Enterprise security operations centres work best when all alert streams flow into one place — Anexet Premium pipes its DLP and insider-threat events directly into your SIEM.
Enterprise security operations centres work best when all alert streams flow into one place. Anexet Premium adds a dedicated SIEM integration that pipes its DLP and insider-threat events outward, so analysts can correlate file-exfiltration attempts, policy violations, and anomalous user behavior inside the SIEM platform they already operate — without switching consoles.
At the same time, organizations that route employee web traffic through a corporate proxy can activate Anexet's optional ICAP Server component. The proxy passes traffic to Anexet for inspection, blocking, or logging before it reaches the endpoint, closing a coverage gap that endpoint-only DLP tools leave open.
Both capabilities ship as part of the Anexet Premium plan — a single, on-premise deployment that unifies DLP, employee activity monitoring, and IT inventory under one license.
Structured DLP and insider-threat events enriched with user identity, channel, data classification, and policy name — ready to correlate inside your SIEM.
Inspect and block web traffic at the proxy layer before it reaches the endpoint, closing the gap endpoint-only tools leave open.
All event forwarding happens within your security perimeter — no traffic leaves your infrastructure through Scinero.
The SIEM forwarder is available on the Premium plan. The underlying features that generate these events may also run on Advanced where noted.
Triggered when intercepted data matches a content rule, thesaurus, digital fingerprint, or hash bank. Each event carries user, channel, timestamp, and severity.
Logged when Anexet blocks a transfer over HTTP, SMTP, MAPI, FTP, XMPP, USB, print, clipboard, or messenger file transfer.
File create, move, delete, and rename actions on workstations and network shares, flagged when they match a rule. Underlying feature: Advanced and above; forwarding: Premium.
Quarantined and released messages, with approver identity and rationale recorded. Underlying feature: Advanced and above; forwarding: Premium.
Case-state changes from the Investigations module, useful for audit trails in regulated environments.
Risk score spikes and behavioral anomalies surfaced by the Risk Analysis module, including sudden activity pattern shifts.
Web-traffic blocks and content violations detected via the ICAP proxy path, with the originating user and URL. Requires the optional ICAP Server component.
SIEM integration and the ICAP Server are Premium-only features. Confirm the exact forwarding scope and ICAP configuration for your environment during the demo.
Anexet's Central Server and its surrounding functional servers — Security Policies Server, Reporting Server, Investigation Server — generate structured security events as they process intercepted data, enforce policies, and score user risk. These events are forwarded from your on-premise Anexet deployment to your on-premise or internally accessible SIEM, enriched with user identity, channel, data classification, and policy name.
Anexet is deployed fully on-premise; the vendor has no access to your data. The SIEM integration forwards events within your security perimeter — no traffic reaches Scinero's infrastructure. The ICAP Server, when activated, keeps the same boundary: your corporate proxy forwards web traffic to an Anexet component running inside your network, not to a cloud service.
Four steps from a security event on the endpoint to a correlated alert in your SIEM.
Enable the ICAP Server and/or event forwarding in the Administrator Console — a dedicated section alongside Central Server, Mail Processing, and other subsystem controls. The Status Monitor shows live uptime and queue metrics for every component.
1
The Anexet Central Server and its surrounding functional servers generate structured security events as they process intercepted data, enforce policies, and score user risk.
2
Events are forwarded to the external SIEM, enriched with user identity, channel, data classification, and policy name — ready to correlate with network, identity, and endpoint signals from other tools.
3
For ICAP-path coverage, your existing corporate proxy forwards web traffic to Anexet's ICAP Server before delivery. Violations are blocked and logged back to the Client Console alongside endpoint-sourced incidents.
4
Enable the ICAP Server and/or event forwarding in the Administrator Console — a dedicated section alongside Central Server, Mail Processing, and other subsystem controls. The Status Monitor shows live uptime and queue metrics for every component.
1
The Anexet Central Server and its surrounding functional servers generate structured security events as they process intercepted data, enforce policies, and score user risk.
2
Events are forwarded to the external SIEM, enriched with user identity, channel, data classification, and policy name — ready to correlate with network, identity, and endpoint signals from other tools.
3
For ICAP-path coverage, your existing corporate proxy forwards web traffic to Anexet's ICAP Server before delivery. Violations are blocked and logged back to the Client Console alongside endpoint-sourced incidents.
4
Common questions about Anexet's SIEM integration and ICAP Server component.
Anexet sends structured DLP and insider-threat events — security policy violations, blocking activations, file operations audit records, mail quarantine actions, Risk Analysis anomalies, and Investigations milestones. Each event includes the user identity, channel, timestamp, data classification, and policy name so your SOC can correlate them with other data sources inside the SIEM.
Yes. Anexet is deployed on-premise; the vendor has no access to your data. The SIEM integration forwards events from your on-premise Anexet servers to your on-premise or internally accessible SIEM — no traffic leaves your security perimeter through Scinero.
The ICAP integration uses your existing corporate proxy as an inspection point. The proxy passes web traffic to Anexet's optional ICAP Server, which applies content-aware policies and blocks policy violations before the content reaches the user's browser — even on devices where an Anexet endpoint agent is not installed. Agent-based DLP covers richer channel depth (USB, print, clipboard, messengers, cloud drives); ICAP covers proxy-routed web traffic. Both paths report into the same Client Console.
SIEM integration is available on the Premium plan only. The ICAP Server is also an optional Premium component. Both are not available on Standard or Advanced. If you need SIEM forwarding or ICAP proxy inspection, confirm the scope during a product demo.
No new Anexet server type is required specifically for SIEM forwarding — the Central Server and its surrounding components generate and forward events. The ICAP Server is a separately licensed optional component for organizations routing traffic through a proxy. See the Administrator Console's Status Monitor for live uptime of all deployed components.
Yes. Anexet's server components run in a Linux environment. The Client and Administrator consoles also launch on Linux with full functionality, so your team can configure SIEM forwarding and ICAP rules from a Linux workstation. Endpoint agents support Windows, Linux, and macOS (including ARM64).
Tell us about your SIEM platform and security operations setup — we'll confirm the integration scope and arrange a demo or a free trial of Anexet Ultimate.
