Add investigation and response on top of the SIEM you run
ThirdEYE does not ask you to move your logs. It reads alerts and events from your SIEM and sources, adds investigation, correlation and response workflow, and hands cases to your ticketing system.
The problem
The SIEM raises alerts but does not close them
Triage, enrichment and documentation are still manual and repeated for every alert.
Replacing the SIEM is not on the table
Existing data, content and retention are tied to the platform in place.
Sources are uneven
Some systems have a connector, others only a webhook or an export.
How ThirdEYE addresses it
Connect a source
Use the Elastic, Splunk or Wazuh connector, the Windows and Linux collectors, or post JSON to the webhook receiver and event API.
Normalise into one alert model
Events from different sources are mapped to a common structure so rules, correlation and investigation work the same way.
Investigate and decide
Detection rules, correlation and AI-assisted investigation run on each alert, with the reasoning stored.
Send the outcome onward
Escalated alerts become cases, optionally mirrored into TheHive, ServiceNow, Jira, GLPI or Zammad.
Key capabilities and their status
Status labels reflect what is in the product today.
Elastic SIEM real-time ingestion
Streams events from Elasticsearch using Point-in-Time and search_after.
Note: No automated test in this repository. Needs an Elastic deployment.
Splunk connector
Search and notable events from Splunk through its REST API.
Note: No automated test. Needs Splunk URL and token.
Wazuh connector
Pulls alerts from Wazuh and can act as a response provider.
Note: No automated test for ingestion. Needs a Wazuh deployment.
Generic webhook receiver and event ingestion API
Any tool that can send JSON over HTTP can submit events to the platform.
IBM QRadar
Offense and event retrieval and offense closing.
Note: Small connector; no automated test.
Microsoft Sentinel
Incident and alert retrieval only.
Note: KQL queries are explicitly not yet implemented.
Windows event collector and Linux agent
A PowerShell forwarder for Windows event logs and a Linux agent.
Note: Not exercised by automated tests.
Ticketing sync: TheHive, ServiceNow, Jira, GLPI, Zammad
Cases can be pushed to and synced from an external ticketing system, with a secret-protected inbound webhook.
Note: Tested against mocked HTTP. TheHive is the provider being validated first; the others are optional.
Where it fits in your environment
Elastic real-time ingestion uses Point-in-Time with search_after. Splunk and Wazuh connectors are implemented through their REST APIs. Any other source can post events over HTTP.
The integration catalogue lists every connector with its maturity.
Scope to know about
- Connectors need credentials and network access from your deployment.
- The Elastic, Splunk and Wazuh connectors are implemented but have not been validated here against live third-party systems.
- QRadar and Sentinel connectors are partial. Sentinel KQL queries are not yet implemented.
Discuss your SIEM setup.
Book a walkthrough with the team. We will show the platform end to end, tell you what is production-ready and what is not, and discuss how it would sit next to your existing SIEM.