Built for engineers. Multiplies your team.
Community is for everyone. Enterprise scales your team and adds: collaborate on detection work in Projects, integrate with the SIEMs you already run, close coverage gaps in minutes instead of days, and run AI Routines that keep your library tuned and current on a schedule.
Community
For individual detection engineers.
- Build a personal detection library
- Translate detections across Sigma, KQL, SPL, CQL, YARA-L, and more
- Unlimited AI Assistant to generate and refine detections, with persistent chat history
- Search and filter community detections with saved views
- Access community threat intel and Intel Reports
- Subscribe to saved searches with email alerts
- Personal knowledge base
Enterprise
For security teams automating threat hunting and detection engineering.
- Everything in Community
- Nightwatch. Automatically researches relevant threats, hunts your telemetry for evidence of impact, checks coverage, and drafts detections tuned to your environment.
- AI agents. Ask questions about your detection library, tune and translate detections in bulk, and schedule audits for stale IOCs, duplicate coverage, and missing documentation.
- Private team workspace
- Projects to organize detection work across your team
- Sync and deploy detections across Google SecOps, Microsoft Sentinel, SentinelOne, Splunk, Cortex, and GitHub
- Coverage tracking. See your coverage against CVEs, MITRE ATT&CK, and threat actors, with historical trends.
- Reporting. Generate coverage reports for leadership and audit.
- Connect your TIP sources to turn threat intel into coverage analysis and new detections.
- REST API and MCP server
- Enterprise SSO
Three problems Enterprise closes.
Agents that hunt and engineer for you.
Nightwatch picks up new intel as it publishes, decides whether it applies to your environment, and hunts your telemetry for it. Findings and draft detections are waiting when you get in, and every answer shows its work: the intel it came from, the queries it ran, the coverage it compared against.
Tune and manage what you already run.
Ask where your gaps are for ClickFix and get an answer grounded in your library and your environment, not a generic feed. Scheduled audits surface stale rules, duplicate coverage, and missing documentation, and suggest the tuning. Generate a report for leadership in one click.
Detection as code, deployed to the systems you already run.
Read from and write back into Google SecOps, Microsoft Sentinel, SentinelOne, Splunk, and GitHub. Version it, review it, audit the drift. SAML SSO, REST API, and an MCP server make it work the way a security org already operates.
Questions you'll have.
Talk to our team.
Get a real reply from a real person.