Threat detection

Threat detection on the same data as your monitoring

Start from 3,665 SigmaHQ rules mapped to 170 MITRE ATT&CK techniques, test each rule in shadow mode before it can page anyone, and respond through 25 actions that run only after a person approves them.

Start free Book a demo Read the security docs

3,665 SigmaHQ rules
170 ATT&CK techniques
25 approval-gated actions

Rules from SigmaHQ under the Detection Rule License 1.1. MITRE ATT&CK® technique data © The MITRE Corporation, reproduced with its permission.

Security alertsLast 15 minutes

All lanesIncidentAnalystShadow

SeverityRuleAI triageTechnique

CriticalLinux Reverse Shell Indicatorpool-b-node-3Malicious 0.93incidentT1059.004

HighSuspicious Download and Execute Pattern via Curl/Wgetpool-b-node-3Suspicious 0.74analystT1059.004

HighProcess Execution From Shared Memory Directorypool-b-node-3Suspicious 0.69analystT1027.011

MediumWget Creating Files in Tmp Directoryci-runner-2Benign 0.88analystT1105

SOC triage · pool-b-node-3A script fetched with curl ran from /dev/shm and opened a shell to 203.0.113.44. Next: contain the host.Proposal waiting for an adminContain host

How it works

From the first event to an approved response

Detections, verdicts, cases and responses share one workspace and one ledger, so the trail from event to action stays intact.

01CollectCollectors send Linux process, file and network events, and logs from firewalls and other security tools.
02DetectInstall the SigmaHQ pack, write your own rules, or convert supported Splunk SPL and Sentinel KQL.
03TestA rule in test runs in shadow mode: alerts are recorded and nobody is paged.
04TriageTurn on the SOC triage agent and each firing alert gets a verdict, a confidence and a lane, citing evidence.
05RespondAgents and playbooks file proposals. A person approves each one, and containment needs an admin.
06RecordCases chain their evidence by hash, and every action lands on the SOC ledger.

Detection rules

Rules you can prove before they page anyone

Pack rules install disabled. Move each one to test, where it runs in shadow mode, and promote it once its backtest and shadow hits look right. A rule whose log source has no route to your data is saved disabled, with the reason.

Backtest any rule over the last 24 hours, 7 days or 30 days, with its exceptions applied
Keep rules in Git: a detection repository stays in sync, and every change is a version you can diff and roll back
Each SigmaHQ rule keeps its original YAML and author, under the Detection Rule License 1.1

Process Execution From Shared Memory DirectorySigmaSigmaHQ · DRL-1.1 · T1027.011High

Stage

Draft
Test
Production

Shadow mode: alerts are recorded, nobody is paged.

Backtest · last 30 days3 matches · 2 hosts

Shadow hits · last 24 hourspool-b-node-31

Promote to productionEdit exceptions

Response

Agents propose. People approve.

Brain, the SOC agents and playbooks file proposals into one queue. Each action carries a blast tier that decides who may approve it, and its target is pinned when the proposal is filed.

Tiered approval
Editors approve notifications, cases and indicator blocks. Containment, account changes and edge blocks need an admin.
Pinned targets
A process is pinned by id, start time and program, a file by path and SHA-256. Changed targets are refused.
Your tools, your credentials
Bind actions to CrowdStrike, Microsoft Defender, Okta, Entra ID, Cloudflare and more, or a signed webhook.
One verifiable ledger
Every proposal, approval and action lands on a hash-chained ledger.

Response actionsCase 312

Proposed · 1ApprovedExecuted · 2

Contain hostpool-b-node-3Tier 2 · admin approvesFiled by SOC triage · 14:23 UTCMalicious, 0.93. Reverse shell to 203.0.113.44 after a curl download.Runs throughCrowdStrike Falcon · Contain hostApproveReject

Block indicator203.0.113.44Tier 1Executed

Open a caseCase 312Tier 0Executed

Investigations

Evidence that still holds up after the incident

Cases snapshot each alert, indicator and entity when you attach it, and chain every item with SHA-256. Drop, edit or reorder an item and the chain breaks from that point on.

When turned on, the SOC investigator opens one case per incident and pins a report that cites the attached evidence
Threat-intel indicators match events as they arrive, and a retro-hunt replays the last 7 days
Auto-close stays off until an admin turns it on, and then only for rules where analysts agree with the agent often enough

Case 312 · Reverse shell on pool-b-node-3Opened by SOC investigator · 14:24 UTCIncident

EvidenceCustody chain intact

#1Alert14:21Linux Reverse Shell Indicator · pool-b-node-3sha256 4a1f09c2e7b3

#2Indicator14:21203.0.113.44 · seen on 1 hostsha256 7be241d05f9a

#3Entity14:22pool-b-node-3 · risk 82sha256 c09d7a5513e6

#4Note14:24Investigation report, pinned to the timelinesha256 5e13d2b8a40c

Each item's hash covers the one before it.

Better together

Security on the same data and inventory as everything else

Detections run on the logs and hosts you already monitor, in the same workspace as your traces, devices and configuration history, so an investigation can follow an alert wherever it leads.

Response actions

What each response action reaches, and who approves it

All 25 actions run only after approval. Tracix runs some itself or through the collector on a host; the rest call a tool you bind with your own credential.

Target	Actions	Runs through	Approved by
Cases and notifications	Notify the SOC, open a case, attach evidence	Tracix	Editor
Indicators and watchlists	Block or unblock an indicator, add to or remove from a watchlist	Tracix	Editor
Detection rules	Enable or disable a rule	Tracix	Editor
Host files, read only	Scan files with YARA	The collector on the host	Editor
Host processes and files	End a process, quarantine or restore a file	The collector on the host, where its owner allowed host response at install	Admin
Endpoint isolation	Contain or release a host	CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne and five more EDRs	Admin
Endpoint processes	Kill a process	Bitdefender GravityZone, ESET PROTECT or Trend Micro Apex One	Admin
Identities and keys	Disable a user, revoke sessions, force a password reset, disable an API key	Okta, Microsoft Entra ID, Keycloak, JumpCloud and more	Admin
Network edge	Block or unblock an IP address	Cloudflare, FortiGate, Check Point, F5 BIG-IP and more, or edge ACLs on Arista EOS and Nokia SR Linux through NCM	Admin
Mail	Quarantine a message	Microsoft Graph, through the Entra ID pack	Admin
Forensics and rebuilds	Request forensic collection, reimage a host	A task for a person to complete	Editor, admin to reimage

Any vendor action can instead post a signed webhook to your own automation. An approved action with no binding becomes a task for a person to mark done. MITRE ATT&CK® technique data: © The MITRE Corporation. ATT&CK® is reproduced and distributed with the permission of The MITRE Corporation.

FAQ

Questions security teams ask first

Talk to a security engineer

Where do the detection rules come from?

From SigmaHQ. The pack holds the 3,665 rules from one pinned SigmaHQ release that compile against Tracix's event schema, and each keeps its original YAML and author under the Detection Rule License 1.1. Technique mappings use MITRE ATT&CK®. © The MITRE Corporation. ATT&CK® is reproduced and distributed with the permission of The MITRE Corporation.

Will every rule work on my data?

Only where your data covers its log source. Linux process, file and network rules run on the collector's endpoint security events without any mapping, and other sources route through the Sigma log source mapping. A rule with no route is saved disabled, with the reason.

Can an agent contain a host without a person?

No. Agents and playbooks only file proposals. Containing a host, changing an account or blocking an address at the edge needs an admin's approval, and the target is pinned when the proposal is filed.

Does Tracix match software to known vulnerabilities?

Yes, through software inventory. Tracix matches the components the collector finds in running applications against OSV advisories, and the matches appear on each service and under Security findings, with KEV, EPSS and runtime evidence. It doesn't pull or scan container images or registries.

Install the rule pack and test it in shadow mode

Connect a collector, install the SigmaHQ pack, and backtest the rules you care about before any of them can page you.

Start free Read the guide

Threat detection on the same data as your monitoring

From the first event to an approved response

Rules you can prove before they page anyone

Agents propose. People approve.

Tiered approval

Pinned targets

Your tools, your credentials

One verifiable ledger

Evidence that still holds up after the incident

Security on the same data and inventory as everything else

What each response action reaches, and who approves it

Questions security teams ask first

Install the rule pack and test it in shadow mode