Every batch the endpoint agent ships lands here the instant it arrives, whether or not it trips a rule. This is the heartbeat: if it's moving, telemetry is live.
Waiting for the first shipment…
Lane 1
Rule / Signature detections (per event)
Regex + YARA + anomaly over host telemetry. Each hit raises a row.
Time
Host
Detector(s)
ATT&CK ID
Technique
Tactic
Evidence
Waiting for detections…
Lane 2
ML — per-process attack model (live)
A process is Sysmon EventID 1 plus every later event with the same ProcessGuid. Each one is scored on 137 behavioural features (command-line shape, parentage, integrity, what it touched) — never hostnames, users or hashes. Scores are re-computed as a process keeps acting, so they can climb.
Score
Host
Process
Command line
Events
Verdict
Flagged at
Waiting for the ML lane…
Treat as triage, not verdict: held-out F1 0.653. The benign class was an idle lab VM, so busy desktops (browsers, installers, admin scripts) can score high. Lane 1 and Lane 2 are independent — agreement between them is the strong signal.