One platform from signal to decision
ThirdEYE is built as a single pipeline rather than a bundle of separate modules. Each stage hands its reasoning to the next.
Built in, and optional
Built in: detection rules and correlation, Security AI, investigation, decision thresholds, playbooks, cases, dashboards, access control and audit. Optional and yours to configure: SIEM and source connectors, LLM providers or local models, threat-intelligence keys, ticketing providers and live response providers.
Event and alert ingestion
- Configurable Elastic SIEM real-time ingestion
- Configurable Splunk connector
- Configurable Wazuh connector
- Configurable Generic webhook receiver and event ingestion API
Detection and correlation
- Available Detection rule catalog: 103 built-in plus 1,293 imported Sigma rules
- Available Behavioural correlation and kill-chain progression
- Available MITRE ATT&CK mapping and navigator
- Available UEBA statistical anomaly scoring
AI investigation
- Available Automatic alert investigation loop
- Available Security AI: rule and memory resolution before any LLM call
- Configurable Multi-provider LLM with failover, local models and built-in fallback
- Available Similar past incidents memory
Decision and response
- Available Decision thresholds with logged justification
- Available SOAR playbooks: 58 built-in, builder, AI generator, approvals, rollback
- Configurable Live response actions (EDR, identity, firewall)
Cases and ticketing
- Available Case management with SLA, evidence chain and reports
- Configurable Ticketing sync: TheHive, ServiceNow, Jira, GLPI, Zammad
Operations and governance
- Available SOC operations dashboard on database-side counts
- Available LLM usage log, token budgets and per-tenant LLM policy
- Available Hash-chained audit trail for AI and response activity
- Available Role-based access control
What is actually built
Counted from the product, not estimated. Each number says what it does and does not mean.
- 13agents
- 8 control agents (triage, investigation, SOAR, UEBA, dark web, compliance, threat hunter, auto-remediation) and 5 specialists. Depth varies by agent. See details
- 1,412ATT&CK workflows
- An Investigate and a Respond runbook for each of 706 MITRE techniques. All manual: an analyst approves, nothing runs by itself. See details
- 58built-in playbooks
- Plus 108 one-click prompts in 9 categories that make the AI generator draft new ones for your review. See details
- 1,396detection rules
- 103 written for the platform and 1,293 imported from the open Sigma project, with a visual builder for your own. See details
- 5LLM providers
- Groq, Gemini, Mistral, OpenAI and local Ollama. The default chain holds 10 hosted free-tier models before a paid or local one. See details
- 6step fallback chain
- Groq, Gemini, Mistral, OpenAI, Ollama, then built-in rules. Analysis degrades instead of stopping, and fallback results never auto-close an alert. See details
- 38MCP gateway tools
- 18 read-only enrichment, 5 investigation, 1 AI summary and 14 action tools that always need approval. Optional: ThirdEYE runs without it. See details
- 23MCP server tools
- Alerts, investigation, incidents, enrichment, playbooks, hunts and agent control, available to any MCP-capable AI client you connect. See details
- 2database modes
- A PostgreSQL cluster, or a local fallback that syncs back automatically when the primary returns. Recovery sync is tested; two-server failover is a documented design. See details
How it complements what you already run
ThirdEYE reads from your SIEM and log sources and writes cases to your ticketing system. It does not require you to move data, and it does not claim to replace a SIEM, EDR or SOAR product. Where it overlaps, for example with playbooks, you choose how much to use.
Actions that change systems run in simulate mode until live mode is enabled and a provider is configured.
See it on your own alerts.
Book a walkthrough with the team. We will show the platform end to end, tell you what is production-ready and what is not, and discuss how it would sit next to your existing SIEM.