AlphaSOC

Signal, Not Noise

Add rich context on-stream to power your detections.

Security data pipelines route telemetry but do not add the required context to uncover threats. AlphaSOC enriches raw events with threat intelligence and reputation scoring. With no threat feeds or lookup tables to maintain, you can focus on building effective detections.

Get started for freeRead the docs
THE CHALLENGE

You’re not seeing the complete picture

Alerts often land in the queue without context: no prevalence metrics, no threat intelligence, no reputation score, and no verdict. Security teams patch these gaps with third-party APIs and threat feeds, but these are wired-in after the fact, adding further cost and complexity.

Add Rich Context

AlphaSOC normalizes your telemetry to OCSF and enriches events with prevalence, threat intelligence, and real-time reputation data.

Your team receives complete detection findings, including evidence, that correlate back to raw events stored in a unified, open format within our data lake.

observablecdn-sync.telemetry.io
prevalenceunique to your environment
domain age6 days
wisdom flagsc2uniqueyoung_domain
time seriesbeaconing behavior
mitre att&ckT1071:TA0011

A Managed Security Data Platform

Integrate your existing tools with our platform to find threats before they become incidents.

Collect & Normalize

Load raw telemetry from any source

Automatically map events to OCSF

Enrich & Detect

In-built threat intelligence and scoring

Bring your own Sigma detection rules

Index & Store

Run fast, optimized, low-cost searches

Long-term retention for threat hunting

Six Dimensions of Analysis

AlphaSOC normalizes and enriches every event. Detection logic is then applied to uncover anomalies and threats.

Intelligence Correlation

We check telemetry against 1M curated, live indicators from 70+ commercial and open sources.

Harness Field-Tested Detections

AlphaSOC maintains a comprehensive library of managed detections that align with MITRE ATT&CK to highlight known threat actor tactics, techniques, and procedures.

Source
Detection
Severity
MITRE ATT&CK
GitHub API calls by a malicious caller
Initial Access
Okta actions indicating impersonation
Defense Evasion
AWS GuardDuty disabled
Defense Evasion
Potential ransomware note uploaded to an AWS S3 bucket
Impact
Outbound TCP port scan indicating hacking tool use or infection
Discovery
Slack team member logged out due to a compromised device
Initial Access
AWS MFA device disabled
Persistence
Azure Storage account modified to allow public blob access
Exfiltration
Azure VM command run
Execution
Use of Azure APIs by a likely malicious caller
Initial Access
GCP KMS key destroyed
Defense Evasion
Telegram Bot API traffic indicating possible infection
Command & Control
Out-of-band application security testing traffic requiring investigation
Discovery
Quarantine applied to possibly compromised AWS credentials
Initial Access
Multiple requests to long hostnames indicating DNS tunneling
Command & Control
DNS misconfiguration leading to potential compromise
Initial Access
Azure VNet flow logs deleted
Defense Evasion
1Password values exported
Exfiltration
Anonymizing circuit setup indicating infection or evasion attempt
Defense Evasion
Okta FastPass blocked a phishing attempt
Credential Access
AWS API calls indicating EKS privilege escalation in multiple clusters
Persistence
Traffic to a destination serving malicious JavaScript
Execution
AWS S3 bucket modified to allow public access
Exfiltration
Successful Okta login after multiple MFA pushes
Credential Access
AWS console login from an EC2 instance
Defense Evasion
AWS EBS snapshot modified to allow public access
Exfiltration
MFA disabled for GitHub organization or Enterprise account
Persistence
Unexpected Slack API calls indicating malware share
Execution
Atlassian actions by a likely malicious caller
Initial Access
GitHub branch protections were disabled for the repository
Defense Evasion
AWS Security Hub disabled
Defense Evasion
Slack organization deleted
Impact
Suspicious hosting provider traffic
Command & Control
Azure Front Door WAF policy deleted
Defense Evasion
AWS IAM user created with admin policy attached
Persistence
Confluence site exported
Exfiltration
GCP GKE control plane exposed to internet
Defense Evasion
Okta suspicious session cookie
Credential Access
AWS decoy resource accessed
Discovery
Okta MFA bypass attempt detected
Defense Evasion
AWS policy modified to allow any principal to assume an IAM role
Initial Access
Traffic to a malicious spear phishing site
Initial Access
AWS RDS snapshot modified to allow public access
Exfiltration
AWS IAM role assumed by an unknown external principal
Initial Access
GCP BigQuery dataset made public
Exfiltration
GitHub SSH key added by suspicious IP address
Persistence
Azure PostgreSQL firewall allows public access
Defense Evasion
Jira user added to administrative group
Privilege Escalation
Outbound SSH traffic indicating brute force activity
Credential Access
GitHub secret scanning disabled or bypassed
Defense Evasion
Azure disk snapshot export URI generated
Exfiltration
Secret found in a GitHub repository
Credential Access
AWS EC2 credential used from an unknown external location
Credential Access
AWS API calls indicating Lambda privilege escalation
Privilege Escalation
Google Drive file shared publicly
Exfiltration
AWS KMS customer managed key disabled or scheduled for deletion
Defense Evasion
Atlassian admin API token created
Persistence
Google Workspace suspicious login
Initial Access
Cryptomining indicating infection or resource abuse
Execution
AWS access key created by the root account
Persistence
GitHub repository deploy key modified or created
Persistence
GCP IAM workforce pool modified
Persistence
AWS policy modified to allow unknown principal to assume an IAM role
Initial Access
Azure network security group modified to allow public access
Defense Evasion
GCP GCS bucket made public
Exfiltration
AWS network infrastructure modification opening a wide range of ports
Defense Evasion
Possible 1Password login brute force
Credential Access
GCP BigQuery data exfiltration
Exfiltration
Unusual excessive AWS S3 bucket deletion requests
Impact
1Password service account token activity
Persistence
GitHub audit log stream modified
Defense Evasion
AWS access key created
Persistence
GCP VPC flow logging disabled
Defense Evasion
Google Workspace account hijacked
Initial Access
Multiple Okta login failures from a single source
Credential Access
Jira actions by a likely malicious caller
Initial Access
High number of non-public GitHub repositories downloaded
Exfiltration
New Okta API token generated
Persistence
Atlassian administrator impersonated another user
Defense Evasion
Slack EKM unenrolled
Defense Evasion
Traffic to malicious infrastructure capturing credentials
Credential Access
Slack application access expanded
Persistence
Slack actions by likely malicious caller
Initial Access
Multiple rejected Okta MFA push notifications for a single user
Credential Access
P2P activity
Defense Evasion
Okta suspicious activity reported
Defense Evasion
GCP Logging sink deleted
Defense Evasion
Azure Network Watcher deleted
Defense Evasion
Traffic to a known malware distribution site
Execution
Confluence public link for a page turned on
Exfiltration
GitHub repository made public
Exfiltration
Traffic to a known sinkhole indicating infection
Command & Control
AWS identity added to an admin group
Privilege Escalation
Excessive disruption of Slack user sessions via invalidation
Defense Evasion
Okta admin role assigned
Privilege Escalation
Azure diagnostic setting deleted
Defense Evasion
AWS API calls indicating setup of mass mailer script
Privilege Escalation
Several unsuccessful Slack login attempts indicating brute force activity
Credential Access
1Password actions by a likely malicious caller
Initial Access
View all detections →
A Sigma detection rule on GitHub detecting Impacket lateral movement activity

Detect Anything™
with Sigma Rules

Sigma is an open source YAML format used to create and share detection rules. We enable threat hunters to quickly deploy new rules and uncover emerging threats within their cloud, application, network, and endpoint logs.

Our detection engine natively supports Sigma, meaning there is no need to translate rules into a proprietary query language (e.g., KQL or SPL) before use.

There is no SIEM™

Offload expensive processing to a dedicated engine

Complex detection logic doesn’t belong inside a traditional SIEM. AlphaSOC processes telemetry before it reaches your stack to deliver context-rich detection findings to your team. There are no lookup tables to maintain, no threat feeds to set up, and no classifiers to build.

Measurable Benefits

The benefits are not abstract. Each traces directly to a specific capability.

Rich context

Enrich data before scoring, not during triage. AlphaSOC findings carry prevalence, threat intelligence, and reputation data. Analysts and agents get rich context to power their hunts and investigations.

Wide coverage

Overlay our in-built detections and your own custom Sigma rules with MITRE ATT&CK to uncover both known and unknown threats across cloud workloads, applications, networks, and endpoints.

AI-ready

AlphaSOC stores prevalence, reputation, and threat intelligence data using OCSF, not freeform text. AI agents reason over the same enriched data your analysts do, with no extra lookup step.

Cost control

We undertake Internet-wide scans and operate a threat intelligence platform with 1M+ curated indicators from 70+ sources. There are no additional threat feeds or third-party API keys to purchase.

Work with Enriched Data

Add context to your cloud, application, network, and endpoint logs with AlphaSOC’s threat intelligence and reputation scoring to drive effective detections, threat hunts, and investigations.

Get started for freeRead the docs