Detection engineering with a catalog you can read and change
ThirdEYE loads 1,396 detection rules, 103 written for the platform and 1,293 imported from the open Sigma project, and lets your team add its own.
The problem
Rule coverage takes years to build
Starting from nothing leaves gaps that attackers find first.
Alerts arrive one at a time
Single events rarely show a multi-stage attack unless they are linked.
Nobody knows which rules are noisy
Without feedback on false positives, tuning is guesswork.
How ThirdEYE addresses it
Start from a catalog
Built-in rules and the imported Sigma catalog load together; built-in rules win ties.
Build and tune your own
A visual rule builder creates custom rules, mapped to MITRE ATT&CK techniques.
Correlate across alerts
The correlation engine links alerts by shared source, technique, asset and time window and tracks kill-chain progression.
Learn from outcomes
Investigation results and analyst feedback feed quality views such as false-positive rate per detection source.
Key capabilities and their status
Status labels reflect what is in the product today.
Detection rule catalog: 103 built-in plus 1,293 imported Sigma rules
The catalog holds 1,396 rules (103 hand-written and 1,293 imported from the Sigma project) with a visual builder for custom rules.
Note: The visual rule builder is a UI feature without a dedicated backend test. Sigma rules belong to their authors under the Detection Rule License 1.1 and must be attributed. Counted by loading the catalog.
Behavioural correlation and kill-chain progression
Correlates related alerts (shared source, technique, asset, time window) and tracks multi-stage progression.
MITRE ATT&CK mapping and navigator
Alerts are mapped to ATT&CK techniques and tactics, with a technique drilldown.
UEBA statistical anomaly scoring
Statistical (not LLM-based) anomaly scoring on user and host activity feeds the same alert pipeline.
Similar past incidents memory
Completed investigations are stored in a tenant-scoped semantic memory and searched for similar history.
Where it fits in your environment
Sigma rules are authored by the SigmaHQ community and distributed under the Detection Rule License 1.1. ThirdEYE keeps their attribution with the catalog.
Catalog size is a count of rules loaded by the product, not a measure of detection coverage.
Scope to know about
- Rule count is not coverage. Effectiveness depends on your log sources and tuning.
- In the default Security AI configuration only high and critical alerts go through rule-based resolution, and Sigma-based resolution is off until enabled.
- The catalog has not been independently benchmarked.
Review the detection catalog with us.
Book a walkthrough with the team. We will show the platform end to end, tell you what is production-ready and what is not, and discuss how it would sit next to your existing SIEM.