Detections
Start with rules that fire. Then make them yours.
Every shipped rule comes with the test events that prove it works. Import what you already trust, write what you need, and see coverage against ATT&CK without a spreadsheet.
Rule shapes
Three kinds of rule.
Query
Match a single event or a count of events per entity in a window. The bread and butter.
Sequence
Ordered stages within a window: a brute-force burst, then a success, then a service install.
Correlation
The same stages on one entity in any order, for behaviours that do not arrive neatly.
Bring your own
Sigma in. KQL and EQL too.
- Sigma rules import directly and arrive disabled, staged for your review before anything fires.
- Subsets of KQL and EQL compile to native rules; the import names anything it cannot compile, so you know exactly what runs.
- Indicator-match rules turn a threat-intel list into detections at ingest pace, with retro-hunt across retention when a new indicator lands.
- Every rule records who wrote it, when it last matched, its false-positive rate and whether the AI agreed with analysts on it.
Content pack
Shipped rules, tagged and tested.
The content pack covers common Windows and Linux techniques, each rule tagged with its ATT&CK technique and shipped with test events.
Noise control
Exceptions and suppressions that show their work.
- Exceptions compile into the rule and can carry an expiry for a maintenance window.
- Suppressions apply after a match, span rules, and count what they swallowed so a rule eating real alerts is visible.
- An ATT&CK coverage matrix shows which techniques your enabled rules reach and where to add more.
- Baseline signals flag per-host and per-organization rarity, with the counts behind every signal.
See XenXDR on your own telemetry.
A 30-minute walkthrough on fictional data, then a pilot in your environment. No slides, no pressure.