Aegisyst Documentation

Reference material for engineers integrating Aegisyst with their SIEM, ingesting threat intel, or building automated detection workflows. All API examples assume base URL https://aegisyst.com/api.

§ Getting Started

Aegisyst is an AI-assisted detection engineering platform. In under five minutes you can generate a Sigma rule for a MITRE ATT&CK technique, translate it to your SIEM's query language, and push it to a live connector.

Quick start

1. Create a free account (50 rules + 30 AI generations / month, no card required).
2. Open /agents and generate a rule for a MITRE technique (e.g. T1059.001 — PowerShell).
3. In /integrations, connect your Splunk HEC / Elastic / Microsoft Sentinel.
4. In /schema-profiles, paste a sample of your logs so translations use YOUR field names.
5. Run Send test event from the connector card. That's a full round-trip.

Plans at a glance

§ Intelligence Library

The Aegisyst Intelligence Library at /feed is a public, no-login-required feed of curated Sigma detections. Each entry exposes its title, MITRE ATT&CK technique tags, and the detection_logic_description — the three-sentence Chain-of-Thought block the AI produces (strategy → exclusions → tuning guidance).

Curation

The feed is auto-curated. Candidates are Sigma rules with status approved or deployed, ranked by community verification count and recency. Admins can pin a rule to the top of the library with the star toggle in the Rule Lab table, which sets featured: true on the rule. The library ships pre-seeded with 10 production-grade 2026 threat detections (LOLBAS curl, Kerberoasting, M365 mass-download, AWS IAM escalation, npm supply-chain, MFA fatigue, Lambda backdoor, K8s SA token abuse, VSS deletion, OAuth phishing).

Community verification

Any signed-in user can mark a rule Verified. Verifications are one per account per rule and are idempotent — posting again removes your vote. The aggregate count is public social proof; the identity of individual verifiers is never exposed through the API.

Free Builder trial (one translation)

Any signed-in account that is not on a paid plan gets one free full translation, for life. Hitting Translate free · 1 left on any library rule burns the allowance, reveals that rule's complete Sigma body, and renders its Splunk SPL / Sentinel KQL / Elastic EQL / Wazuh XML output. The unlock is sticky — it survives reloads and sign-outs — and every other rule stays gated with a “Free trial used” tooltip. Re-posting for the same rule is idempotent; posting for a different rule returns 409 trial_used.

Tier gating

Viewer and Free-tier visitors see the full narrative for every rule, plus a truncated YAML preview. Multi-SIEM Translate and Sync to GitHub remain visible but non-interactive with an “Upgrade to Builder” tooltip. Builder is the marketing name for the paid team plan — the gate is the same multi_siem_translation feature flag used everywhere else in the platform.

§ Deception Module Enterprise

The Deception Module turns Aegisyst into an active-defence surface. It is gated on the deception_module feature flag, which is only true for accounts resolved to the enterprise plan — either via the tier: "enterprise" property on the user document, an admin comp grant, or a paid Enterprise subscription. Every other tier sees the controls rendered with a lock icon and an upgrade tooltip.

Honey-user decoys (T1078.002)

Generate Decoy (next to the rule generator on the Coverage Map, and on the AI Agents page) mints a Sigma rule for a fake service account such as srv_metabase_admin. The rule matches every Windows Security authentication path for that principal — logon (4624/4625), explicit credential use (4648), Kerberos TGT/TGS (4768/4769) and NTLM validation (4776). Because the account has no legitimate consumer, no allow-list is applied and the rule ships at level: critical. Generation is deterministic — no LLM call, no AI-quota spend.

title: Decoy — honey service account used (srv_metabase_admin)
type: decoy                      # ← every decoy rule carries this marker
tags:
  - attack.persistence
  - attack.t1078.002
  - aegisyst.deception
  - aegisyst.honey_user
detection:
  selection:
    EventID: [4624, 4625, 4648, 4768, 4769, 4776]
    TargetUserName: 'srv_metabase_admin'
  condition: selection
level: critical

Logic randomization

The Randomize toggle in the Multi-SIEM tabs re-emits the same detection as functionally equivalent but syntactically different query logic, so an attacker who has seen one tenant's detection content cannot fingerprint yours by string matching. Transformations per target: wildcard equality → case-insensitive regex (match() in SPL, matches regex in KQL, regex~ in EQL, type="pcre2" fields in Wazuh), randomized clause ordering, a neutral eval/extend alias, and a randomized Wazuh base rule id. Pass a seed to make a variant reproducible for change control.

Auto-randomize on export

Enterprise accounts can flip Auto-randomize on export (on the AI Agents → Deception Module card). Once on, every live SIEM push is re-emitted with randomized logic server-side, so the deployed artefact never matches the content you see in the editor:

• POST /api/integrations/connectors/{id}/deploy-rule — pass rule_id and the Wazuh XML is regenerated from the stored Sigma before the PUT. The response carries randomized: true and the audit entry records it.
• POST /api/v1/spl/deploy (the Splunk App pull) — every Sigma rule is returned as randomized SPL, with a per-rule randomized flag and a top-level randomized_count.

§ Threat Feed

A background watcher polls public threat intelligence, checks each item against your rule library, and asks the AI agent to draft Sigma for the gaps. Everything it finds surfaces in the Active Threats banner at the top of the dashboard.

Sources & cadence

• CISA Known Exploited Vulnerabilities — what attackers are exploiting right now (highest ranking weight).
• SigmaHQ community repo — newly added / updated detections, read through the public GitHub API (set GITHUB_TOKEN to raise the rate limit; not required).
• MalwareBazaar — optional, needs a free MALWAREBAZAAR_AUTH_KEY. Samples are informational and never rank as high priority.

The loop runs in-process every 6 hours (AEGISYST_THREAT_POLL_SECONDS), starting 90s after boot, and writes a watermark to system_state so restarts are safe. Set AEGISYST_THREAT_FEED_ENABLED=false to disable it.

Coverage gating & AI drafts

A threat is uncovered when no rule in the library references its CVE id, its upstream Sigma id, or an identical title. Uncovered items with high/critical severity are flagged priority: high. Each poll spends its AI budget (AEGISYST_THREAT_AI_DRAFTS, default 3) on the newest high-priority gaps — Claude Opus 4.7 drafts a Sigma rule that is saved to the shared Rule Lab queue as:

name:    "[HIGH PRIORITY] <threat title>"
status:  draft          # never auto-deployed
priority: high
origin:  threat_feed
threat_intel_id: <linked threat>
author:  threat-intel@aegisyst.com

§ Authentication

All API endpoints (except public marketing / config endpoints) require a Bearer JWT. Get a token by calling POST /api/auth/login.

# Request
POST /api/auth/login
Content-Type: application/json

{"email": "you@company.com", "password": "..."}

# Response
{
  "token": "eyJhbGciOi...",
  "user": { "id": "...", "email": "you@company.com", "role": "analyst", "plan": "free" }
}

Include the token in every subsequent request:

Authorization: Bearer eyJhbGciOi...

§ API Reference

All endpoints are prefixed with /api. Rate limits are applied per user, not per IP.

Rules

AI Generation

Integrations

Threat Intel

Metrics

§ SIEM Comparison Matrix

Sigma is the portable syntax; SIEMs are anything but. This live widget shows exactly how a single Sigma rule is rewritten into Splunk SPL, Microsoft Sentinel KQL, and Wazuh XML by Aegisyst's translator — then explains why the shapes diverge.

title: Suspicious Encoded PowerShell
id: 4e1f6b83-1a5f-4b9d-a5df-52d7c8b7e2f9
status: stable
description: Detects PowerShell invocations that use the base64 encoded-command
  form, a common signal of obfuscated payload execution.
author: Aegisyst Docs
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_powershell:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
    CommandLine|contains:
      - '-EncodedCommand'
      - '-enc '
  condition: selection_powershell
level: high

# Suspicious Encoded PowerShell
# Detects PowerShell invocations that use the base64 encoded-command
index=* sourcetype=WinEventLog:*
| search ((process="*\\powershell.exe" OR process="*\\pwsh.exe") AND (process_exec="*-EncodedCommand*" OR process_exec="*-enc *"))
| eval detection_name="Suspicious Encoded PowerShell", severity="high"
| table _time, host, user, process, process_exec, action, vendor_action, detection_name, severity

// Suspicious Encoded PowerShell
// Detects PowerShell invocations that use the base64 encoded-command
DeviceProcessEvents
| where FileName has_any("\\powershell.exe", "\\pwsh.exe")
| where ProcessCommandLine has_any("-EncodedCommand", "-enc ")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, ActionType, ActionResult
| extend Severity = "high"

<!-- Generated by Aegisyst · base_rule_id=100001 -->
<group name="aegisyst,high,mitre_attack">
  <!-- Suspicious Encoded PowerShell · selection_powershell -->
  <rule id="100001" level="12">
    <if_sid>18100</if_sid>
    <description>Suspicious Encoded PowerShell — Detects PowerShell invocations that use the base64 encoded-command</description>
      <match>\\powershell.exe</match>
      <match>\\pwsh.exe</match>
      <match>-EncodedCommand</match>
      <match>-enc </match>
      <mitre>
        <id>T1059.001</id>
      </mitre>
  </rule>
</group>

§ Integration Guides

Aegisyst for Splunk (Splunk App)

Install the official Splunk App to auto-pull every approved rule from your Aegisyst tenant into savedsearches.conf every 6 hours.

1. Download aegisyst-for-splunk-1.0.1.spl
2. In Splunk Web: Apps → Manage Apps → Install app from file → upload the .spl.
3. Mint a key in /settings/keys, then paste it into the app's Set up screen.
4. First pull runs on the schedule (every 6h). To trigger manually: $SPLUNK_HOME/bin/splunk cmd python $SPLUNK_HOME/etc/apps/aegisyst_for_splunk/bin/aegisyst_pull.py

Splunk HEC

Aegisyst pushes detection events to Splunk over HTTP Event Collector.

1. Splunk UI → Settings → Data Inputs → HTTP Event Collector → New Token.
2. Note the HEC endpoint (e.g. https://prd-p-xxx.splunkcloud.com:8088) and token.
3. In Aegisyst /integrations, click New Connector → Splunk HEC.
4. Paste the URL, token, and index (default: main). Health check runs on save.

Elastic

Uses the standard _bulk API with an API key.

1. Kibana → Stack Management → API Keys → Create API Key (write access to your target index).
2. Copy the encoded key value.
3. In Aegisyst, create an Elastic connector with the cluster URL, API key, and index.

Microsoft Sentinel

Uses the Log Ingestion API via a Data Collection Endpoint + Data Collection Rule.

1. Register an Azure AD application; grant it Monitoring Metrics Publisher on the DCR.
2. Create a DCE, a custom-log table (Custom-Aegisyst_CL), and a DCR that routes to it.
3. Provide tenant ID, client ID, client secret, DCE URL, DCR immutable ID, and stream name to the connector form.

§ Security & Privacy

Data sent to the AI provider

Rule-generation prompts contain only the MITRE technique ID and a short natural-language description you provide. Your logs, alerts, IoCs, and connector secrets are never sent to the AI. Log samples pasted into the Schema Profile analyzer are sent for that single request only and are not persisted.

§ Compliance

Aegisyst was built privacy-first. Current posture:

• GDPR (EU) — no PII is collected without explicit sign-up; auth analytics are irreversibly hashed and auto-purged after 30 days; data export / deletion available via support@spectreai.in.
• DPDP (India) — consent-based signup, data-processor commitments in the Privacy Policy, INR billing via Razorpay for local buyers.
• CCPA (California) — no sale of personal data; opt-out is available by requesting account deletion.
• SOC 2 Type I — planned for 2026 Q3.
• ISO 27001 — planned for 2026 Q4.