Skip to content
SPECIFICTION
Get listed

MaxPatrol SIEM

global.ptsecurity.com

Free trial WebWindowsLinuxSelf-hosted
Visit global.ptsecurity.com
Spec score 8.2 #9 of 29 in SIEM Software

What it is

MaxPatrol SIEM provides visibility into IT infrastructure and helps security teams detect incidents. It collects data actively and passively from more than 300 types of systems, and alerts operators to unavailable sources, unusual event distributions, or delays in event data. Teams can use 20 default dashboard widgets or create their own, and a visual rule constructor supports incident detection rules without requiring code or a rule language. The product maps network topology and updates the map as infrastructure changes. Its Behavioral Anomaly Detection module uses 49 machine-learning models to detect targeted attacks and previously unknown anomalies. Expertise packs bring detection rules, collection and incident-handling parameters, response recommendations, and reputation lists. The product supports custom detection rules, real-time alerting, authenticated scans, and the PDQL query language. Deployment options include self-hosted environments, with Linux distributions and some specified Windows Server versions supported for components. Displaying asset vulnerability information requires a separate MaxPatrol Vulnerability Management license. The vendor offers a pilot; pricing is available on request. Warranty support for valid licenses is available during the update access period.

Spec sheet

Purpose
MaxPatrol SIEM provides visibility into infrastructure and detects security incidents.Read 9 Oct 2026 · global.ptsecurity.com
Intended users
The maker describes the product as helping security staff gain infrastructure visibility and detect incidents across IT infrastructure.Read 9 Oct 2026 · global.ptsecurity.com
Deployment
The help portal lists Linux distributions including Astra Linux Special Edition 1.7 and Debian 10, and supports some components on specified Windows Server versions.Read 9 Oct 2026 · help.ptsecurity.com
Integrations
The product page describes MaxPatrol NAD Sensor as a component that analyzes network traffic, collects asset data, and detects attacks.Read 9 Oct 2026 · global.ptsecurity.com
Support
Positive Technologies says warranty support for valid product licenses is available during the update access period.Read 9 Oct 2026 · help.ptsecurity.com
Headquarters
Moscow, RussiaRead 28 Sep 2026 · global.ptsecurity.com
Founded
2002Read 28 Sep 2026 · global.ptsecurity.com
Asset visibility
Maintains asset history including installed software, events, vulnerabilities, configuration, and topology.Read 9 Oct 2026 · global.ptsecurity.com
Behavioral detection
Its Behavioral Anomaly Detection module uses 49 machine-learning models to detect targeted attacks and previously unknown anomalies.Read 9 Oct 2026 · global.ptsecurity.com
Dashboards
Users can choose from 20 default dashboard widgets or create their own.Read 9 Oct 2026 · global.ptsecurity.com
Data collection
It collects data actively and passively from more than 300 types of systems.Read 9 Oct 2026 · global.ptsecurity.com
Data sources
Collects data actively and passively from over 300 types of systems.Read 9 Oct 2026 · global.ptsecurity.com
Integration limit
Displaying asset vulnerability information requires a MaxPatrol Vulnerability Management license, according to the vendor's version 6.1 release notes.Read 9 Oct 2026 · global.ptsecurity.com
Network analysis
The MaxPatrol NAD Sensor analyzes network traffic, passively collects asset data, and detects attacks including attempts to contact command-and-control servers.Read 9 Oct 2026 · global.ptsecurity.com
Network visibility
The product maps network topology automatically and updates it as the network changes.Read 9 Oct 2026 · global.ptsecurity.com
Pilot
The product page invites organizations to request a pilot; the vendor's 2021 release announcement describes the pilot as free.Read 9 Oct 2026 · global.ptsecurity.com
Rule creation
A visual rule constructor lets users create incident detection rules without learning a language or writing code.Read 9 Oct 2026 · global.ptsecurity.com
Source monitoring
Operators are alerted to unavailable data sources, event-distribution anomalies, or delays in event data.Read 9 Oct 2026 · global.ptsecurity.com
Threat detection
Its BAD module uses 49 machine-learning models and can independently detect targeted attacks and previously unknown anomalies.Read 9 Oct 2026 · global.ptsecurity.com
Threat intelligence
Expertise packs include detection rules, collection and incident-handling parameters, response recommendations, and reputation lists.Read 9 Oct 2026 · global.ptsecurity.com
Threat knowledge
Expertise packs provide new detection rules, updated collection and incident-handling parameters, response recommendations, and reputation lists.Read 9 Oct 2026 · global.ptsecurity.com

Plans and prices

MaxPatrol SIEM Priced on request Pricing by consultation; vendor offers a pilot Read 9 Oct 2026 · global.ptsecurity.com

Every MaxPatrol SIEM plan and price →

Strong points and limits

Strong points

  • Collects data from more than 300 system types.
  • Includes 20 default dashboard widgets.
  • Visual rule creation does not require code.
  • Uses 49 models for behavioral anomaly detection.
  • Supports real-time alerts and authenticated scans.

Limits

  • Pricing is available on request.
  • Vulnerability display requires a separate license.
  • Warranty support is tied to the update access period.

Who it suits

It suits security staff seeking infrastructure visibility, incident detection, and monitoring across many data sources. Organizations should account for self-hosted deployment and the separate license required to display asset vulnerability information.

Verdict

MaxPatrol SIEM combines broad data collection with visual rule creation, network mapping, and behavioral detection. Buyers should clarify pricing, deployment requirements, and the separate license needed for asset vulnerability information.

Where Specifiction places it

Alternatives to MaxPatrol SIEMAll alternatives →