SIEM MonitoringRules · Signals · MITRE ATT&CK · Integrations

Detect Threats Before They Become Breaches

Atatus Cloud SIEM collects security events from your hosts, clusters, cloud accounts and identity tools, runs detection rules over them, and turns every match into a signal your team can triage.

Get started freeSchedule a demo
Cloud SIEMsecurity dashboard
Security SIEM Dashboard
01 / Detection rules

Write the rule. Watch it decide.

Add failed logins and see which case fires. Cases run top to bottom and the first match sets the signal.

Detection rule · Threshold

SSH Brute Force Attempt

Data source
runtime-security-agent
Query
ssh_attempts · Count
Filter
source:runtime-security-agent AND auditdMessageType:USER_AUTH AND auditdResult:fail
Group by
sourceIP hostname
Window
Case name
SSH brute force from %{sourceIP} on %{hostname}
Notify
#security-alerts
Rule builder
  1. Detection methodThreshold
  2. Queriesssh_attempts · Count by sourceIP, hostname
  3. Cases2 cases, first match wins
  4. Say what's happeningTemplate, tags and teams
  5. SuppressionBy sourceIP and hostname
Ready to save

Threshold is one of five detection methods. The others are anomaly detection, new value, impossible travel and static match.

ssh_attempts · last 300 s14sourceIP 203.0.113.24 · host web-01
  1. 1Criticalssh_attempts >= 5014 is below 50
  2. 2Highssh_attempts >= 10First match. Sets the signal
SignalHigh
70/100 risk

SSH brute force from 203.0.113.24 on web-01

Alert sent to #security-alerts
  • 90Critical
  • 70High
  • 50Medium
  • 30Low
  • 10Info

Sample data · default risk score by severity

02 / Signals

Triage in one place.

Open a signal, change its status, assign it or mute it. A signal group moves as one.

  • 5New
  • 10Open
  • 2Investigating
  • 21Resolved
  • 4False positive
Signal queuesample data
High · 70Open

SSH brute force from 203.0.113.24 on web-01

Method
Threshold
MITRE
TA0006 · T1110 Brute Force
Matches
14 events
Assets
sourceIP 203.0.113.24 · host web-01
Owner
Unassigned

Signal group · 4 firesOne rule, one sourceIP and host. A status change here applies to all 4.

  • 14:02:11USER_AUTHrootfail
  • 14:02:13USER_AUTHadminfail
  • 14:02:16USER_AUTHubuntufail
03 / Coverage

See what your sources let you detect.

Turn a data source off and watch which detections go dark.

Data sources

24 of 26 rules can fire
8 of 8 tactics covered

MITRE ATT&CK coveragesample rules and sample mapping
Initial AccessTA0001 · 3/3
ExecutionTA0002 · 2/2
PersistenceTA0003 · 5/5
Privilege EscalationTA0004 · 4/4
Defense EvasionTA0005 · 3/3
Credential AccessTA0006 · 4/4
DiscoveryTA0007 · 2/3
ExfiltrationTA0010 · 1/2
Source offPort scanAWS VPC Flow Logs · Discovery TA0007 · T1046 · sample mappingTurn on AWS VPC Flow Logs and this rule starts evaluating its events.
Security logsFile integrity monitoringSensitive data classifier
04 / In the product

Reports for your auditors.

Framework scores and control status, on the Reports tab.

Cloud SIEMreports
Atatus SIEM reports with SOC 2, PCI-DSS, HIPAA, ISO 27001 and NIST CSF scores and a controls table
FAQ

Questions about SIEM

Pricing, deployment, data and the agent. If something is missing, a person will answer it on a demo call.

Talk to an engineer

  • Each integration takes two steps: create read-only credentials in the source, such as Okta, GitHub or AWS CloudTrail, then paste them into its form under Security, Cloud SIEM, Integrations and click Connect. Events appear within one or two poll cycles, and the default poll interval is 5 minutes. For hosts and clusters, turn on Linux audit logs, Kubernetes audit logs or file integrity monitoring with Atatus agent version 4.2.0 or later.

  • No. Atatus SIEM includes a built-in detection library that Atatus maintains and maps to MITRE ATT&CK. You can turn each built-in rule on or off, override its severity and notifications, or clone it into a custom rule that you can edit.

  • Atatus SIEM runs in the same platform as your APM, logs and infrastructure monitoring, and the same agents collect Linux audit logs, Kubernetes audit logs and file changes. One filter language writes rule queries and searches signals, and every signal carries its MITRE ATT&CK tactic and technique.

  • You control the noise. Repeated fires of one rule are grouped into a signal group that you triage once. You can mute a signal for 1 hour, 24 hours or 7 days, add a suppression to the rule and preview how many signals from the last 24 hours it would hide, disable or override noisy built-in rules, and turn off Notify so a rule records signals without alerting anyone.

  • Atatus has no per-user pricing, so every analyst on your team can work in the SIEM without adding seats. The pricing page lists current plans, and you can try Atatus free for 14 days.

  • Yes. The rule builder has five steps: detection method, queries, cases, notification and suppression. You write each filter in the visual builder or in DSL mode, click Test rule to check it against recent data, and can export or import rules as JSON.

  • Open it from Security, Signals. The detail view shows the severity and status, the rule and its MITRE ATT&CK tactic and technique, how many events matched, the affected assets such as the source IP, host or user, and a sample of the matching events. Opening a signal moves it from New to Open. From there you can mark it Investigating, Resolved or False positive, assign an analyst or copy a permalink.

  • Each rule can send its signals to Slack, Microsoft Teams, Email or PagerDuty, and each case can set its own target, such as #security-alerts, so Critical and High signals go to different places. The notification is a Markdown template that can include matched values and @here or @on-call mentions, and a rule can route to up to five teams.

Get started

Rules, signals, coverage. One SIEM.

Start free trialRequest demo

Write rules, triage signals and see which attacks your data sources let you catch.

  • SaaS
  • On-premises
  • Hybrid
  • BYOC
  • No per-user pricing

Compare Atatus with Splunk · Sumo Logic