ROOTKey vs SIEM: do I need both?
Short answer
A SIEM collects and correlates the logs and security events your systems produce, so your team can detect and investigate suspicious activity. ROOTKey works on the data itself: it seals a fingerprint of every version of your files, tables and records, catches any change - what, who, when and where - and restores only what was altered. Your SIEM detects events; ROOTKey answers which data can still be trusted after an alert. If you need both answers, you need both, and ROOTKey's events reach your SIEM through the REST API and webhooks.
- Detection
- Continuouswhat, who, when and where
- To your SIEM
- REST APIand webhooks
- Fingerprint
- SHA-256for every version, with a timestamp
- Scope
- File · table · rowonly what was altered
Side by side: SIEM and ROOTKey
A SIEM looks at the events your systems report. ROOTKey looks at the content of your files, tables and records. The table sets out what each one does.
| SIEM | ROOTKey | |
|---|---|---|
| What it answers | What is happening across our systems, and is any of it suspicious? | Which data can still be trusted, and what exactly changed? |
| What it records | Logs and security events collected from systems, applications and network devices | A SHA-256 fingerprint of every version of every file, table or record, sealed with a timestamp in an independent public registry |
| Third-party proofintegrity proven to others | Not its purpose: it keeps and analyses the events it receives | Every critical action produces an independent proof that external auditors can verify without access to the original data |
| Change detailwhat, who, when and where | Shows the activity that systems report, such as sign-ins, access and alerts, as far as each source logs it | Shows the change in the content itself - row, cell or field, before and after - with who, when and where |
| Selective restoreonly what was altered | Not its role: a SIEM does not restore data | Yes: the last version proven valid, down to one file or one row |
| Independent verification | Works from the events that the monitored systems report | Compares the data itself with a fingerprint sealed in an independent public registry |
| Existing storageworks with what you use | Collects events from the systems it is connected to | Direct connectors to SharePoint, OneDrive, Amazon S3 and Cloudflare R2; the REST API and webhooks for every other system, your SIEM included |
| Regulatory evidence | Supports monitoring, detection and incident handling | A cryptographic audit trail, integrity reports and evidence packs for NIS2 (Art. 21, 23), DORA (Art. 9, 17) and GDPR (Art. 32) |
When you need each
- SIEM
- To monitor activity across many systems, correlate events, raise alerts and support your security operations team when it investigates an incident.
- ROOTKey
- When the question is about the data itself: whether a file, table or record was changed, exactly what changed, which version can be trusted, and how to prove it to an auditor or a regulator.
They answer different questions and work best together.
How they work together
ROOTKey's events are available to your SIEM through the REST API and webhooks, so your team sees changes to the data alongside the rest of its security events.
Anchor
Every version of every file, table or record gets a unique fingerprint, sealed in an independent public registry with a timestamp.
Detect
ROOTKey continuously compares your data with the sealed record and raises an alert on any modification, explained: what, who, when and where.
Correlate
The events reach your SIEM through the REST API and webhooks, next to the events from the rest of your infrastructure.
Recover after an alert
When an alert fires, ROOTKey shows which data was altered and which can still be trusted, and restores only what was altered to the last version proven valid. Every action is sealed with a cryptographic timestamp, forming a chain of custody that is ready for auditors and exportable for regulators.
Connectors, API and webhooks: Integrations.
Frequently asked questions
Does ROOTKey replace my SIEM?
No - it complements it. Your SIEM detects events; ROOTKey answers which data can still be trusted after an alert. They answer different questions and work best together.
How does ROOTKey integrate with our SIEM?
Events are available through the REST API and webhooks for your SIEM.
Can a SIEM show what changed inside a file?
A SIEM works from the events that systems report, such as access and activity. ROOTKey compares the file itself with its sealed original and shows only what was altered - row, cell or field, before and after - with who, when and where.
Where does ROOTKey run?
ROOTKey runs as SaaS hosted in the EU, in your own cloud account, inside your own infrastructure, or as a hybrid that keeps the data on-premise with separate SaaS dashboards.