Skip to content

Detections that actually detect.

Vendor-neutral detection engineering for any SIEM or EDR platform.

We make your security tools catch real attacks, with fewer false alarms and lower logging costs. No security team? We'll set the tools up too.

Request a detection review See what we do

Same attack caught, far fewer false alarms. Switch between the two versions of this rule to see the difference.

5 alerts. 4 are false alarms from your own IT tools. 1 alert. The real attack: a booby-trapped invoice.

Show the rule behind thisHide the rule
rules/windows/proc_creation_encoded_powershell.yml 
title: Encoded PowerShell Command Lineid: 3f9c2a71-5d0e-4b8a-9e62-1c7d4a0b8f15status: testlogsource:  category: process_creation  product: windowsdetection:  selection:    Image|endswith: '\powershell.exe'    CommandLine|contains:      - ' -enc '      - ' -EncodedCommand '  filter_sccm:    ParentImage|endswith: '\CCM\CcmExec.exe'  filter_intune:    ParentImage|endswith: '\AgentExecutor.exe'  condition: selection  condition: selection and not 1 of filter_*level: mediumlevel: hightags:  - attack.execution  - attack.t1059.001  - attack.t1027.010

process_creation · last 5 minutes

Process creation events and whether the selected rule version alerts on each
time host parent → command line verdict
09:13:51 WS-0102 svchost.exe → taskhostw.exe – –
09:14:02 FS01 CcmExec.exe → powershell.exe -NoProfile -enc SQBuAHYA… false alarm ignored: IT tool
09:14:09 WS-0231 AgentExecutor.exe → powershell.exe -enc JABwAHIA… false alarm ignored: IT tool
09:14:58 WS-0231 explorer.exe → chrome.exe --type=renderer – –
09:15:31 WS-0118 explorer.exe → powershell.exe -File .\backup.ps1 – –
09:16:20 WS-0412 OUTLOOK.EXE → WINWORD.EXE /n "Invoice_0412.docm" – –
09:16:44 WS-0412 WINWORD.EXE → powershell.exe -w hidden -enc JABjAD0A… real attack real attack
09:17:03 WS-0187 AgentExecutor.exe → powershell.exe -enc JABsAG8A… false alarm ignored: IT tool
09:17:52 DC02 svchost.exe → wsmprovhost.exe -Embedding – –
09:18:11 FS02 CcmExec.exe → powershell.exe -NoProfile -enc SQBtAHAA… false alarm ignored: IT tool
09:18:40 WS-0231 cmd.exe → ping -n 1 10.0.4.12 – –

Example data. The highlighted line is the attack: someone opened an infected invoice attachment, and it secretly ran a hidden command. Tuning teaches the rule to ignore your known IT tools, so it still catches everything else.

Most teams run default rules.

Default rules are written for every network, so they fit none of them. The bill arrives three ways.

Alert noise
Analysts learn to skim, and the alert that matters looks like all the others.
Missed attacks
Techniques nobody wrote a rule for go through quietly, with nothing to tell you they did.
Logs nobody reads
You pay to ingest and store data that no detection ever uses.

Fixed scope. Fixed price.

Every engagement is scoped in writing with a firm price before work starts.

Written in the language your tools speak.

  • KQL
  • SPL
  • ES|QL
  • EQL
  • YARA-L
  • Sigma

Microsoft Sentinel and Defender, Splunk, Elastic, Google SecOps, CrowdStrike and others. If your platform runs it, we write it.

No security team? You still need a SIEM.

Auditors and insurers expect logging and alerting. If nobody on staff owns security, we set it up and run it.

  • The right SIEM for your size

    Chosen for your budget and what you already run, such as Microsoft 365. No overbuying.

  • Set up and connected

    Email, endpoints, firewall and cloud logs flowing in, with retention set to what you need.

  • Mapped to your requirements

    HIPAA, PCI DSS, SOC 2, CMMC or your cyber insurance questionnaire. Evidence you can hand over.

  • Run for you, if you want

    Alerts tuned so they mean something, with optional monthly management so it does not go stale.

Get set up

We help you meet logging and monitoring requirements. Certification is up to your auditor.

Your brand. Our detections.

For managed service providers. We build and maintain the detections; you deliver them to your clients under your own brand.

  • Detections in each client's platform language
  • Tuned per client environment, maintained as threats change
  • Nothing your clients see carries our name
Ask about white-label

From first message to a repo you own.

  1. Send a short request

    Tell us your platform and what is bothering you. It takes two minutes.

  2. We reach out

    A call about your environment, your tools and what you need to catch or comply with.

  3. Fixed-price scope

    A written scope and a firm price before any work starts. No hourly billing.

  4. Delivery in a Git repo you own

    Detections, tests and documentation. Optional retainer for ongoing tuning.