Cyberolog Fleet keeps a heartbeat on every rule in your SIEM. It checks each one, branch by branch, and shows which can still fire. Each answer comes with the evidence behind it.
Read-only to start. Nothing in your SIEM is changed.
Live means rules are inventoried, checked and attack-tested on that SIEM today.
It says enabled. It hasn't matched anything since March.
Fields go empty, parsers change, sources move. The rule stays green in the SIEM and can never fire again.
We cover T1059. Has anyone checked?
An ATT&CK mapping is a claim. The heatmap turns green whether or not the rule ever caught the technique.
Turned it off during the incident. Forgot to turn it back on.
The 3 a.m. fix leaves a gap for months, exactly where an attacker would want one.
Who disabled this rule? And why?
Scripts, analysts and vendor auto-tuning all toggle rules, and nobody can say who changed what.
Forty customers, forty copies of the same rule. Which ones still work?
Each tenant has its own log sources and field names. A rule that fires for one customer can be blind for the next.
The customer asks what they are paying for. We send an alert count.
Alert volume says nothing about coverage. Proof per rule is something a customer can read and an auditor can keep.
of SIEM rules are broken and will never fire.
CardinalOps, State of SIEM Detection Risk 2025, 13,000+ rulesof simulated attacks were logged, but only 14% raised an alert.
Picus Blue Report 2026A log source changes, a field goes empty, a parser is updated. The rule stays green and stops matching.
The last two are where detections fail without anyone noticing.
Every rule is inventoried hourly, with its query hash and full change history.
Alerting, monitoring, staged or switched off, and who set it that way.
Each field and each branch of the query is checked against real events. A rule can be half dead and look healthy.
A safe simulated attack runs on a test host. The rule passes only if it matched. If the telemetry never arrived, the verdict is “inconclusive”, not “pass”.
Cyberolog Lab is public and live: a filtered public view of the fleet's real record. It shows failed runs and untested rules as they are.
Straight from the fleet's own record. Every line is a real event on the lab SIEM; every rule name opens its receipt.
Rules can be onboarded from SigmaHQ, and other sources plug into the same intake. Each one passes the same checks as the rules you already run, before it is allowed to alert.
A rule that filters on a field your SIEM never fills is held back, not deployed blind.
The draft is linted and compared with the rules already in place.
The rule is created parked, in a mode the SIEM does not run. Only a reviewer's approval starts it, in silent monitoring.
After a quiet period, healthy data and a passed attack test, it can move to alerting. Promotion is automatic only if you switch it on.
One record per rule: its mode and who set it, the data check for each branch, the attack test result, and every change since day one. A value that was never measured is shown as “not recorded”, never as zero.
DORA Article 10 requires detection mechanisms to be regularly tested. NIS2 asks you to assess whether your security measures are effective. A receipt per rule is that evidence.
If you run SIEMs for others, each customer gets their own login and sees only their own rules. You can show what is proven, not only what is deployed.
The same checks and the same receipt on every SIEM we connect. Live today on nano.rs and Splunk.
Automation is optional and comes later, one customer at a time, when you decide.
Inventory, data checks, quality review and noise findings need no write access.
If you turn automation on, a single governor is the only thing that can change a rule, under a mass-change cap and a stop switch.
A noisy rule drops to silent monitoring, keeps watching, and is re-armed when it's quiet, or at once if triage suspects a real incident.
Who, when, why, and the evidence behind it, in the rule's history. Open any rule on the live Pulse to read its receipt.
We connect with a read-only account and watch your rules for 30 days. At the end you will receive one report you can forward.