AEGISYST
MITRE ATT&CK v14 · Sigma · YARA · KQL

The AI Detection Engineer for Your SOC

Threat intel → tested Sigma → deployed rule in under a minute. Try the translator below — no sign-up.

Built on MITRE ATT&CK v14. Ships to Splunk, Elastic, and Microsoft Sentinel with signed health checks and full audit trail. Free tier — 50 rules and 30 AI generations per month, no credit card required.

What operators said on Product Hunt
See the full thread
Veysel
@veysel981611·18d ago
finally a detection tool that feels like it was built by people who've actually triaged alerts. the mitre mapping alone saves me hours every week.
“the mitre mapping alone saves me hours every week”
Sıraç Kanyılmaz
@sirackanyilmaz·18d ago
love that the rules stay on-prem, that alone makes it worth a look for my team. one thing i'd love is a built-in regression suite that fires back historical true positives against new rule versions so i can see if a "tuned" rule suddenly stops catching things it used to. would save a lot of nervous deploying on friday afternoons.
“love that the rules stay on-prem”
Maker replyShipped — see Validate with Confidence below.
Add your take
Tell us what your SOC needs next — we ship it fast.
Sigma source
558 chars
title: Suspicious PowerShell downloading remote payload
id: 00000000-0000-0000-0000-aegisyst-demo
status: production
description: Detects powershell.exe downloading remote content — a common initial-access technique.
author: Aegisyst
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'DownloadString'
      - 'Net.WebClient'
  condition: selection
level: high
Sigma · 557 chars
Powered by the same schema mapper that ships every rule in Aegisyst.
Built forSplunkElasticMicrosoft Sentinel
Free tier · 50 rules / month + 30 AI generations
How Aegisyst works

Threat intel → AI logic mapping → Validated rule

step 01
Input Threat Intel
Paste a CISA KEV entry, MalwareBazaar hash, GitHub advisory, or a raw log sample. Aegisyst normalises it against MITRE ATT&CK v14.
step 02
AI Logic Mapping
The detection agent drafts Sigma/YARA/KQL, maps to your Custom Log Profile fields, and dry-runs against your historical TP baselines.
step 03
Validated Rule Export
One deploy-ready rule per SIEM — Splunk SPL, Sentinel KQL, Elastic EQL, Wazuh XML — signed with MITRE tags + a passing regression report.
StepInputOutputTime
1. Threat intel arrivesCISA KEV · abuse.ch MalwareBazaar · your CTI feedMITRE-tagged item queued for detection~5s
2. Aegisyst generatesMITRE technique + short descriptionSigma rule + SPL/KQL/EQL/XML translations · regression pass~20s
3. DeployedRule + configured SIEM connectorLive in Splunk / Elastic / Microsoft Sentinel~5s
Median end-to-end≈ 30s
Key features

Everything a detection engineer actually needs

4 SIEMs
one source
Multi-SIEM Translation
Author once in Sigma. Aegisyst emits deploy-ready Splunk SPL, Sentinel KQL, Elastic EQL, and Wazuh XML in the same pass — with your Custom Log Profile fields highlighted inline.
<1s
regression
Pre-deployment Sandbox
Every rule runs against your saved true-positive baselines before it ships. See pass/fail per baseline in <1s so you never deploy a rule that broke a known detection.
600+
techniques
MITRE ATT&CK Alignment
Every rule is tagged to a specific technique (v14) and rendered on your live coverage map. Gaps are surfaced against CISA KEV so your backlog is priority-sorted.
Detection regression suite

Validate with Confidence

Every tuned rule carries a hidden risk: the fix might silently stop catching what it used to. Aegisyst's Regression Suite re-runs your logic against a curated corpus of historical true-positives on every save — so a small edit never costs you a real detection.

Zero silent regressionsDeploy on FridaysFull audit trail
Historical TP corpus
Every rule accumulates a private library of the true-positive alerts it caught. That corpus becomes the ground truth for future edits.
Replay on every save
The moment you tune a rule, we re-fire each past TP through the new logic. Broken detections are surfaced before the change hits your SIEM.
Save-blocked on regression
If a change would silently drop even one historical hit, the save is blocked with a diff of the sample logs that no longer match — no more Friday-afternoon surprises.
Override with an audit trail
Ready to accept a regression? Force-save with a single click; the override, the operator, and the failing samples are captured in the audit log.
Green & deployable
A save that clears every historical TP fires an instant passed · N / N baselines badge in the Rule Editor. If even one baseline breaks, the save is gated until you review the failing samples.
Platform showcase

See the three surfaces that move the needle

01 · Rule Generation
Author Sigma directly in a Monaco editor with a live sandbox that validates against your true-positive log samples in under a second.
02 · Verification Sandbox
Every rule replays against your saved true-positive baselines on save — so a refactor that would break a known detection never ships.
03 · Explainability Panel
One glance shows the MITRE technique, every SIEM's translation, and exactly which fields your Custom Log Profile remapped inline.
Trust & Security

Your detections stay yours

The security decisions we've made so a SOC team can put Aegisyst on their production stack without a months-long procurement review.

Data isolation per tenant
Every workspace is siloed at the Mongo collection query layer — your rules, log samples, and API keys are only ever readable by your user_id. Nothing you write to Aegisyst is visible to any other tenant, staff included, without an explicit support ticket + logged access.
TLS 1.3 everywhere
Every request between your browser, the Splunk Connector App, and the Aegisyst API is TLS 1.3 (HSTS enforced). API keys are stored SHA-256 hashed — we return the raw value exactly once at generation, then we forget it. Revocation is instant.
We don't train on your logs
Custom Log Profile analysis runs through your Universal LLM Key with zero-retention prompts. Your log samples, alert data, and rule content are never fed back into any model, never used for benchmarks, and never shared with any third party.
Full compliance details: /docs#compliance