Observability and security, from code to cable.

1. 01 · DetectThe checkout SLO starts burningA burn-rate monitor pages on-call before customers notice.SLOs · On-call
2. 02 · CorrelateSignals become one problemThe latency spike, the port errors and the config change land in one problem, not three tickets.Problems
3. 03 · ExplainBrain names the likely causeAn MTU mismatch from change 4821, with links to the trace, the port and the diff.Brain
4. 04 · FixA reviewed rollback goes outNCM drafts the rollback, checks it against policy, and a collector on your network applies it after approval.Configuration management
5. 05 · VerifyRecovery is measured, not assumedSynthetic checks and the SLO confirm the fix, and the case closes with a full timeline.Synthetics · Cases

1. 01 · DetectA SigmaHQ rule catches a reverse shellIt fires on pool-b-node-3, from Linux endpoint events the collector already sends.Threat detection
2. 02 · TriageThe triage agent returns a verdictMalicious, 0.93 confidence, routed to the incident lane with its evidence cited.SOC triage agent
3. 03 · ScopeAttack paths show what it could reachPick the host and see everything it reaches within six hops, with the evidence for each.Attack paths
4. 04 · RespondContainment waits for an adminA proposal to contain the host through CrowdStrike runs only after an admin approves exactly what was proposed.Response & playbooks
5. 05 · RecordEvidence that holds up laterThe case chains its evidence by hash, and every action lands on a ledger you can verify.Cases · SOC ledger

Detection rules come from the SigmaHQ project under the Detection Rule License 1.1. MITRE ATT&CK® is a registered trademark of The MITRE Corporation.