How detection works

Every event goes through the same four layers, whether it came from the Windows agent, an SSH server, a log file or the API. An event that one layer misses can still be caught by another.

1. Rules

Detection rules match an event’s fields, tags and type. A rule fires only when every condition it states holds. Each rule carries its MITRE ATT&CK techniques, a severity and notes on known false positives; most also carry test events that prove they fire, and stay quiet when they should. See Detection rules.

Some rules depend on tags computed from earlier events when a new one arrives. Among them:

Tag	Set when
Brute force	5 or more failed logins from one address, or for one account, within 10 minutes
Port scan	One source reaches 15 or more ports within 2 minutes — or 40 or more within 24 hours, for a slow scan
Host discovery	ICMP probes from one source to 10 or more hosts within 2 minutes
Beaconing	Connections from one source to one destination at regular intervals: at least 6 in 30 minutes with a spread of at most 15%. A looser test catches beacons with deliberate jitter.
SMB lateral movement	One source reaches 3 or more hosts on port 445 within 5 minutes
Kerberoasting	Kerberos service-ticket requests for 5 or more different services from one source within 2 minutes
DNS tunnelling	30 or more different subdomain queries from one source within 5 minutes
Mass file change	50 or more files created or changed on one host within 2 minutes
Off-hours admin	An administrator logs on, or gains privileges, outside the tenant’s working hours or at the weekend. Working hours and time zone are set per tenant.

2. Fileless-malware heuristics

Attacks that never write a file show up in command lines and process relationships. The heuristics read every process event for:

Behaviour	ATT&CK
Encoded or download-and-run PowerShell	T1059.001
Living-off-the-land binaries used to run code	T1218
Reading LSASS memory	T1003.001
Process injection, DLL injection, process hollowing	T1055, T1055.001, T1055.012
WMI used to execute	T1047
Scheduled tasks created from the command line	T1053.005
DLL search-order hijacking	T1574.001
Active Directory and domain-trust enumeration, Kerberoasting	T1087.002, T1482, T1558.003
Network, remote-system, security-software and cloud discovery	T1046, T1018, T1518.001, T1526

3. Behavioural baseline

The platform learns each user, host, address, process and domain: how many events it produces a day, at which hours, and which kinds. Nothing is judged until the entity has seven days of history, so the baseline has seen working days and a weekend.

After that, a day whose volume is three standard deviations or more above the entity’s norm raises an alert — high, or critical at five. Activity at an hour that held under 1% of the entity’s history, and an event type never seen from it, are scored but do not raise alerts on their own.

4. Kill-chain correlation

Single events are tied to stages — credential attack, login, execution, persistence, credential dumping, evasion, lateral movement, impact. Only events that a rule or heuristic already flagged count as a stage; a successful login counts as context. When one host shows these combinations within 30 minutes, the platform raises one alert that names the chain:

Chain	Stages	Severity
Credential compromise in progress	Credential attack + login	High
Active intrusion — credential dumping	Login + credential dumping	Critical
Foothold established	Persistence + execution	High
Defense evasion + execution	Evasion + execution	High
Pre-lateral movement	Credential dumping + lateral movement	Critical
Full attack chain	Credential attack + execution + persistence + lateral movement	Critical
Impact phase	Persistence + impact	Critical

Across hosts and sources

Four correlation rules join events across sources:

Rule	Pattern	Window
Brute force → successful login	5 or more failed logins, then a success, from the same address	10 minutes
Recon → exploitation	A port scan on a target, then an exploitation attempt on it	60 minutes
Lateral movement chain	A successful login on one server, then on another, from the same source	30 minutes
Data staging → exfiltration	100 or more file accesses, then a large outbound transfer, from one asset	2 hours

Impossible travel — the same user logging in from places too far apart for the time between — is checked as well.

Where the AI fits

None of these layers is a language model. The AI analyst explains what they found.