Question 1

What is AlphaSOC?

Accepted Answer

AlphaSOC is a security data platform that helps security teams uncover anomalies and targeted attacks across cloud, application, network, and endpoint telemetry. It collects and normalizes logs from virtually any source, enriches them with AlphaSOC's own threat intelligence, and runs managed and custom Sigma detections against them, then indexes and stores everything in AlphaSOC's own data lake. Findings can be escalated to your team the moment they're detected, or investigated later by querying that data lake directly, all without the overhead of a traditional SIEM.

Question 2

How does AlphaSOC's detection pipeline work?

Accepted Answer

AlphaSOC organizes telemetry into three layers, plus two ways your team acts on the output. Collect & Normalize ingests logs from cloud, application, network, and endpoint sources and maps every field to the OCSF standard. Enrich & Detect adds threat intelligence and prevalence scoring, then runs managed AlphaSOC detections alongside your own custom Sigma rules against the enriched result. Index & Store keeps every event, and every piece of evidence AlphaSOC flags along the way, in AlphaSOC's own data lake. From there, you can escalate findings the moment they're detected, since alerting doesn't wait on indexing, or investigate by running federated searches back into the data lake whenever you need to dig deeper.

Question 3

How does AlphaSOC detect unknown "patient zero" threats?

Accepted Answer

Most detection tools can only flag threats they already recognize. AlphaSOC tracks the global prevalence of artifacts, highlights patterns that stand out from the norm, and performs active scanning of malicious infrastructure, so it can surface novel threats that haven't been cataloged anywhere yet.

Question 4

What threat intelligence powers AlphaSOC's detections?

Accepted Answer

AlphaSOC aggregates indicators from 70+ sources, including commercial threat feeds, partner intelligence, and AlphaSOC's own network scanning infrastructure. The result is a managed threat intelligence platform holding over 1 million live, curated indicators.

Question 5

What is Sigma, and how does AlphaSOC support custom detection rules?

Accepted Answer

Sigma is an open, YAML-based format for writing and sharing detection rules. AlphaSOC natively supports Sigma, so your team can deploy new detection logic in minutes rather than translating rules into a proprietary query language.

Question 6

Will my custom Sigma rules conflict with AlphaSOC's managed detections?

Accepted Answer

No. Custom detections merge into Enrich & Detect alongside AlphaSOC's managed ruleset, running through the same scoring pipeline rather than a separate track. There's no override order to manage: your rules and AlphaSOC's managed detections ship side by side, and adding your own doesn't disable or change anything AlphaSOC provides by default.

Question 7

How does AlphaSOC minimize false positives?

Accepted Answer

Every finding is scored across six independent dimensions rather than triggering on a single signal. Multiple corroborating factors have to agree before AlphaSOC raises an alert, which keeps the signal-to-noise ratio high without requiring you to hand-tune every rule.

Question 8

How does AlphaSOC reduce alert fatigue?

Accepted Answer

AlphaSOC correlates and escalates findings rather than surfacing every individual signal on its own. Composite findings are built from multiple corroborating signals across your environment, so your team reviews fewer, higher-confidence alerts instead of a raw feed of isolated events.

Question 9

Does AlphaSOC support retrospective or historical threat hunting?

Accepted Answer

Yes. AlphaSOC stores all ingested telemetry, along with the threat evidence it flags along the way, in its own data lake. Through the AlphaSOC for Splunk integration, you can query that history directly from inside Splunk: by raw event, by the specific evidence AlphaSOC flagged, or by activity, which joins that evidence with the device and user behind it. That makes it possible to reconstruct exactly what happened, who was involved, and what infrastructure was contacted, for any time window you choose. The AlphaSOC console also lets you filter findings by time range, detection type, malware or tool family, endpoint, MITRE ATT&CK tactic, or severity, and drill into the raw events behind any finding.

Question 10

How is AlphaSOC different from a traditional SIEM?

Accepted Answer

Traditional SIEMs charge by ingestion volume, which creates blind spots once your data volume outpaces budget. They often require expensive add-ons for full functionality, impose hard limits on custom detection rules, and can lock you into one vendor's query language. AlphaSOC runs alongside or in front of your existing SIEM as a dedicated detection engine, so you can process all of your telemetry for threats without paying full SIEM ingestion rates for it, and without limits on your own detection logic.

Question 11

How is AlphaSOC different from a security data lake?

Accepted Answer

Generic data lakes are built for storage and exploration, not real-time detection: they carry hidden maintenance costs, make ad hoc investigation cumbersome, and don't score events as they arrive. AlphaSOC includes its own data lake, but detection comes first: every event is enriched and scored against managed and custom detections the moment it arrives, and only then indexed and stored, so you get real-time alerting and a queryable history of everything AlphaSOC has seen, not one or the other.

Question 12

How does AlphaSOC reduce SIEM costs?

Accepted Answer

AlphaSOC takes on detection work that would otherwise run, and be billed, inside your SIEM. Shifting that work to a dedicated engine, and extending coverage to SaaS platforms and cloud workloads, has helped customers reduce SIEM costs by up to 80% without a matching increase in SIEM licensing.

Question 13

Which cloud and SaaS platforms does AlphaSOC monitor?

Accepted Answer

AlphaSOC ingests telemetry from the major cloud platforms (AWS, Google Cloud, and Azure), alongside the identity providers (Auth0, Entra ID, Okta) and SaaS applications (GitHub, Google Workspace, Slack) that run on top of them. Because everything is normalized to OCSF, activity across these environments is analyzed consistently, and the same managed detections and custom Sigma rules apply everywhere.

Question 14

Do I need to install agents to monitor cloud and SaaS environments?

Accepted Answer

No. AlphaSOC has no agents or sensors to deploy. You connect your cloud and SaaS data sources, typically by pointing existing log streams at AlphaSOC, and it begins processing telemetry immediately. Extending detection coverage to SaaS platforms and cloud workloads this way is also part of how customers cut SIEM cost, since that telemetry no longer has to be ingested and billed inside the SIEM to be inspected for threats.

Question 15

What data sources and integrations does AlphaSOC support?

Accepted Answer

AlphaSOC ingests telemetry from identity providers (Auth0, Entra ID, Okta), applications (GitHub, Google Workspace, Slack), cloud platforms (AWS, GCP, Azure), network sources (Cloudflare, Palo Alto Networks, Zscaler), and endpoint tools (CrowdStrike, Microsoft Defender, SentinelOne). The full, continually updated source list is available in our documentation.

Question 16

What deployment models does AlphaSOC offer?

Accepted Answer

AlphaSOC runs as a cloud service or as an on-premise deployment for organizations with strict data residency or regulatory requirements. Either way, there are no agents or sensors to deploy: you connect your data sources and AlphaSOC starts processing telemetry.

Question 17

How long does it take to deploy AlphaSOC?

Accepted Answer

Most customers connect their first data sources and start seeing useful alerts within minutes, with a full evaluation environment running in under an hour and no lengthy professional-services engagement required.

Question 18

Can I manage AlphaSOC and investigate findings using AI agents instead of the web console?

Accepted Answer

Yes. AlphaSOC ships an MCP server that lets you drive the platform with natural language across three areas: pipeline management (configuring log sources, data lakes, and credentials), detection management (tuning existing detections and deploying new ones, including your own Sigma rules), and investigations (federated search against AlphaSOC's own data lake). Pipeline and detection management are read/write, so an agent can configure a new source or ship a new detection directly, not just describe one. Investigations are read-only by design: an agent can query your data, but can't write back into it. That's broader than the investigate-only AI interfaces most vendors offer, since agents can configure and author detections as well as query findings.

Question 19

How do I get started with AlphaSOC?

Accepted Answer

You can start for free in minutes. Sign up for the console to open a self-service workspace, then connect your first data source. As soon as it's flowing, AlphaSOC starts surfacing findings, with no payment details required. If you'd prefer a guided walkthrough, get in touch and our team will set one up.

Question 20

Is there a free trial, and how do I evaluate AlphaSOC?

Accepted Answer

Yes. You can create a self-service AlphaSOC workspace, connect your data sources, and invite colleagues to start generating useful alerts within minutes. It's free, takes under an hour to set up, and includes a 30-day unrestricted evaluation period with no payment details required upfront.

Question 21

What does a typical AlphaSOC evaluation look like?

Accepted Answer

An evaluation is self-service. Sign up for the console to open your workspace, then connect your first data source. From there, AlphaSOC's 1,000+ managed detections run automatically against every source out of the box, with no tuning required, and if you already maintain Sigma rules you can run them alongside the managed detections via Detection as Code. You review the high-fidelity findings in the console, then connect more sources or invite your team to sharpen detection and correlation. A full environment is usually running in under an hour, the 30-day evaluation is unrestricted, and there's no lengthy professional-services engagement. Our documentation walks through each step, and you can reach our team if you want help.

Question 22

Can I evaluate AlphaSOC alongside my existing SIEM?

Accepted Answer

Yes. AlphaSOC runs alongside or in front of your existing SIEM, so you can point the same telemetry your SIEM already collects at AlphaSOC and process it for threats without re-ingesting it. There are no agents or sensors to deploy: you connect data sources and AlphaSOC starts analyzing them. See the documentation for the full list of supported sources.

Question 23

What support is available while I evaluate?

Accepted Answer

The evaluation is self-service and setup takes under an hour, but you're not on your own. Our documentation covers setup, sources, and detections end to end, and you can reach our team any time to scope sources, tune detections, or interpret findings.

AlphaSOC FAQ

Categories

AlphaSOC Overview

Detections & Sigma

SIEM, Data Lakes & Cost

Cloud

Deployment & Integrations

AI & Automation

Trying AlphaSOC

Still have questions?