SIEM
Log collection and detection
Your logs in one place, matched against detections that carry their own false-positive guidance.
A traditional log platform charges for the privilege of sending it data — between roughly €0.50 and €150 per gigabyte per day depending on the vendor — which produces the behaviour where a company logs less in order to afford logging at all. That is the wrong incentive, so ingest here is an allowance inside the price rather than a meter on the invoice.
Included from Core · see the tiers
What it does
Capabilities, with their real status
Collection from the sources you already have
ShippingMicrosoft 365, Entra ID, Windows Event Log and Google Workspace from Core upward. Infrastructure sources — syslog, HTTP event collector, OpenTelemetry, CloudTrail — from Protect. The Windows collector was read against a live System channel rather than a fixture.
One schema across every source
ShippingEvents are normalised to OCSF 1.6.0 so a detection rule is written once instead of once per vendor, and a query about sign-ins does not need to know which product produced them.
A first-party detection library mapped to ATT&CK
ShippingCovering eighty techniques across twelve of the fourteen tactics, with roughly a third of the library devoted to Microsoft 365 identity because that is where attacks on companies this size actually begin. Every rule is authored in-house, so no rule obliges us to print another vendor's name in your alert interface.
Every rule carries false-positive guidance
ShippingThis is enforced: the validation gate refuses to load a rule without it. A rule you cannot interpret is a rule you switch off in week two, and a switched-off rule is worth nothing regardless of how good it looked in a bake-off.
A match is not an alert
ShippingMatches pass through tenant overrides, a windowed aggregation with a threshold and a cooldown, and a shadow-mode gate. A rule in shadow mode records its finding and contributes to risk without creating work for a human — which is the correct behaviour for a rule that fires on a condition you are still remediating.
Per-tenant tuning, audited
ShippingSeverity, thresholds, windows, cooldowns and suppressions are all yours to change, and every change records who made it and why. Lowering a rule's severity lowers its risk contribution too, so tuning cannot quietly hide an entity from the risk engine.
Risk-based alert aggregation
BetaCorrelates a chain into one incident instead of one alert per step — a six-step business email compromise sequence produces a single incident. Built and tested; not yet exercised end to end in production.
The limits
What this module does not do
Every module on this site carries this section. A product page without one is a product nobody has run against a real customer.
- Reconnaissance and Resource Development are not covered. Both happen outside your estate and are not detectable from your telemetry, so a claim of coverage would be a fabrication.
- This is not built for petabyte-scale ingest. A Postgres-backed search is adequate at SMB volume and is part of why the price is what it is.
The rest of the platform
Also included
Identity and access
Every sign-in decided by a rule you can read, and a trace showing which one won.
ReadPAMPrivileged access
Administrators do the work without ever holding the password.
ReadXDREndpoint detection and response
What the suspicious process actually did, and a response you can take back.
ReadFind out what an attacker would see
Connect Microsoft 365 and read your own posture report. 82 checks against your real tenant, naming your real administrators, applications and devices. Free, complete, and yours to keep — not a sample with the findings blurred.
No card. No sales call before you have read the report.