Threat detection and audit-log coverage
in one dashboard

Arden Complete includes everything in Arden Security and Arden Comply: alerts on attacker activity mapped to MITRE ATT&CK, and reports on which logging 133 requirements in seven compliance frameworks depend on. Both run from the same program and the same dashboard.

Request a Beta Invite → Use Cases
What You Get

What Arden Complete includes

Arden Complete has every feature of Arden Security and Arden Comply. Both parts run in the same executable and share one dashboard.
ARDEN
Security
▸ Detection rules mapped to MITRE ATT&CK
▸ Rules spread across several ATT&CK tactics
▸ Lateral movement detection
▸ Credential theft and Kerberoasting detection
▸ Compound risk scoring
▸ Marking and suppressing false positives
▸ Sigma rule support
▸ Dashboard that updates as events arrive
Full security details →
ARDEN
Comply
▸ 133 requirements mapped to the Windows logging they depend on
▸ 7 frameworks: CJIS, HIPAA, PCI DSS, CMMC, NIST SP 800-171, SOX, FERPA
▸ 56 monitored event categories
▸ Which event categories were observed, per requirement
▸ Per-host filtering
▸ PDF, CSV and JSON export
▸ Ongoing collection of audit events from agents
▸ Logging gaps listed by framework
Full compliance details →
Why Both Matter

Why detection and logging evidence belong together

After an incident, two questions usually follow: what did the attacker do, and was the right logging in place at the time? Arden Complete helps you answer both from the same data.
Ransomware hits your file server
If the attacker's steps show up in the event logs, Arden Security can alert on the lateral movement, the PsExec service install and an earlier credential dump. Arden Comply's report shows whether logon, privilege use and object access events were being recorded on those machines during that period, which an auditor or investigator will likely ask about.
T1570 Lateral Transfer CJIS 5.4.1 HIPAA 164.312(b)
An admin account is compromised
Arden Security can alert on a Kerberoasting attempt and on unusual NTLM authentication. Arden Comply's report shows whether account management, credential validation and failed logon events were being recorded, so you know what the logs can and can't tell you about that account.
T1558 Kerberoasting PCI DSS 10.2 CMMC AU.L2-3.3.1
An audit is coming up
Rather than pulling logs by hand, you can export the audit-log coverage report as PDF, CSV or JSON, filtered by framework, requirement, host and time period. Detection keeps running on the same server while you work on it.
SOX Section 404 FERPA 99.31
You need to monitor 50 machines
You deploy agents from the dashboard to the machines you choose. Each agent sends its event logs to your Arden server, and the dashboard shows alerts and audit-log coverage for all of them. You can filter by host, framework or severity.
Network Edition Agent Deploy
Deployment Options

Run it on one machine or across your network

The Standalone edition looks at one machine's logs, or EVTX files you copy in. The Network edition collects from agents on other machines. Both run on a Windows machine you already have, with no database or separate collector to set up.
Standalone
Runs on a single machine and analyzes that machine's event logs, or EVTX files exported from other machines.
▸ Analyze local event logs
▸ Import EVTX files from other machines
▸ Detection and audit-log coverage reporting
▸ No network access needed
▸ Useful for triage on a single host
Network
Collects events from agents on your other Windows machines into one server and dashboard. You can scan for hosts and deploy agents from the dashboard.
▸ Scan a subnet (CIDR range) for hosts
▸ Agent deployment from the dashboard
▸ Agents keep sending new events
▸ Filter alerts and reports by host
▸ Audit-log coverage for every host with an agent

Request a beta invite

Arden is in an invite-only beta, and each tester license runs for two weeks. If you'd like to try Arden Complete on your own logs, request an invite.

Request a Beta Invite →