SOC Prime Attack Detective

Attack Detective is an enterprise-ready SaaS solution that provides real-time data and content audits for comprehensive threat visibility and improved detection coverage, equips security teams with low-noise and high-quality rules for alerting, and enables automated threat hunting. It connects real-time threat surface visibility and existing security data with prioritized detection content, MITRE ATT&CK, and CTI to quickly identify and tackle cyber threats before they escalate.

Connect your SIEM via API to instantly pinpoint blind spots in your detection coverage and assess your threat detection efforts. Establish content management CI/CD without integrating third-party tools, take advantage of content repos, reverse translation and rule editing capabilities. Rely on automation to run all queries against all the data you have.

Backed by Amazon Security Lake, Attack Detective ensures security teams can efficiently investigate incidents while saving development time with reusable rules & queries automatically convertible to Athena and OpenSearch in the OSCF format.

Attack Detective Enterprise subscription licenses include:

• Supported integration with the following cloud-native SIEM and EDR technologies: Amazon Athena, Amazon Security Lake, AWS OpenSearch, Microsoft Sentinel, Microsoft Defender for Endpoint, Splunk Cloud, Elastic Cloud
• 400% faster analysis speed compared to the freemium tier, using dedicated high-speed scanning infrastructure
• Up to 100 Threat Surface scans per month leveraging MITRE ATT&CK to discover prevalent techniques, tools, and suspected threat actors
• Over 10,000 Sigma rules used for a Threat Surface scan based on customer data availability, SIEM, EDR, and DWH types
• Access to detection rules that produced a hit during a Threat Surface scan (the rule number depends on the active subscription)
• Up to 100 Data Audit scans per month, depending on the chosen license
• Complete suggestions on MITRE ATT&CK data coverage and blind spots grouped by Data Components, Log Sources, and Tools
• Export of data audit results to ATT&CK Navigator and DeTT&CT open-source tools
• Ability to add custom detection rules and IOC-based queries to the threat surface scan
• Assigned Customer Success Manager
• Support availability 9x5 during weekdays GMT timezone via Slack and email

Learn more about each subscription license at https://my.socprime.com/pricing/attack-detective/ . Please note that these licenses are for End-Customer use only. For MSSP and MDR use, please contact us.