Rules matched to your data
Rules are sorted by whether the data they need is already arriving, so you turn on the ones that will work today and see what to add for the rest.
Detection rules
Rules checked against the past.
Before a new detection rule goes live, armor360 shows how often it would have fired on the alerts you already have, so a noisy rule is caught before it wakes anyone.
Every rule is a trade.
Too few rules and attacks go unseen. Too many, or too loose, and the real alerts drown.
Rules that cannot fire
A rule that needs logs you do not collect looks like coverage but catches nothing.
Noisy on day one
A rule that fires hundreds of times a day is usually found out after it goes live, by the people it wakes.
Gaps you cannot see
Which attack techniques do your rules actually cover? The answer is rarely written down.
Changes without control
A rule switched off to quieten a bad night may never come back on.
See the noise before a rule goes live.
A draft rule is run against the alerts you already store, so you know how often it would fire before it is switched on.
Two draft rules, tested on the last 30 daysIllustrated example
Any archive created in /tmpToo noisy
Would have fired 473 times
Archive created, then copied to a staging folderReady to approve
Would have fired 3 times
Tested on your past alerts
Before a rule goes live, armor360 shows how often it would have fired on the alerts you already store. A rule that would have fired too often is caught before it reaches anyone.
Rules written for you
Ask the agent to draft a rule and it writes one for your SIEM, which you can narrow or edit before it goes for approval.
Coverage you can show
An ATT&CK report shows which attack techniques your live rules cover and where the gaps are, ready in minutes rather than built by hand.
Changes stay controlled
A rule goes live when a person approves it, and switching a rule off needs two administrators to agree. The record shows who did what.
How a rule goes live.
- 1
Check the data
Each rule in the library is sorted by whether the data it needs is already arriving: ready now, needs more data, or locked.
- 2
Choose or draft a rule
Pick a ready rule from the library, or ask the agent to draft one in plain words. You can narrow or edit the draft before it goes further.
- 3
Test it on the past
armor360 shows how often the rule would have fired on your stored past alerts, so a noisy rule is caught while it is still a draft.
- 4
Approve and record
A person approves the rule before it goes live. Switching a rule off later needs two administrators, and each change is kept in the audit trail.
Detection engineering, with a safety net.
Ready, needs data, locked
Every rule is sorted by whether it can work on your data today.
Back-tested
See how often a rule would have fired before it is switched on.
Drafted by the agent
Ask for a rule in plain words, then narrow or edit the draft.
ATT&CK report
Techniques covered and gaps, in one report.
Approved by a person
Nothing goes live without someone saying yes.
Two to switch off
Turning a rule off needs two administrators.
A new rule, by hand and with armor360.
TopicBy hand todayWith armor360
Data readinessRules are switched on in bulk from a library, and some can never fire because their logs are not collected. Each rule is marked ready now, needs more data or locked, so you switch on the ones that can work today.
Writing itAn engineer writes the query by hand, checking field names and syntax against the documentation. When a person asks, the agent drafts the rule for your SIEM, and that person narrows or edits it.
Testing itNoise is usually found after go-live, when the rule fires on routine activity and the queue fills up. The rule is checked against stored past alerts first, showing how often it would have fired.
Switching offOne person can turn a noisy rule off on a bad night, and it may never be turned back on. Turning a rule off needs two administrators to agree, and the record shows who did it and when.
CoverageWhich ATT&CK techniques are covered is pieced together in a spreadsheet, and goes out of date quickly. An ATT&CK report is built from the rules you actually run, showing techniques covered and the gaps.
Frequently asked questions
Which rule formats does armor360 use?
Rules are switched on in your SIEM, starting with Elastic Security, so they run where your data already is. armor360 manages which rules are live, checks them against your past alerts and keeps the record of each change.
Why does switching a rule off need two people?
Because turning a rule off removes protection, and it is the change most likely to be made in a hurry. Asking a second administrator to agree keeps a quiet night from becoming a permanent gap. Switching a rule on needs one person’s approval.
What is the ATT&CK report?
A report of which MITRE ATT&CK techniques your live rules cover and which they do not. It is built from the rules you actually run, so it shows your real coverage rather than a vendor’s list.
Read next
More of the platform
See where your team’s time goes. Then decide.
Start a free pilot on your own alerts, or put in your own numbers first.