Skip to main content
Ciyora Detect

From raw events to a correlated incident

Ciyora Detect brings logs, endpoint telemetry and identity signals into one pipeline. Detection rules are mapped to MITRE ATT&CK, related signals are stitched into incidents, and analysts can query endpoints, inspect process trees and run response actions without leaving the console.

Request a demoRead the Ciyora Detect docs
A critical incident in Ciyora Detect, credential theft and lateral movement from a finance workstation, with owner, detection sources across email, endpoint, network and identity, affected assets and identities, and the ATT&CK techniques involved.A critical incident in Ciyora Detect, credential theft and lateral movement from a finance workstation, with owner, detection sources across email, endpoint, network and identity, affected assets and identities, and the ATT&CK techniques involved.

What Ciyora Detect does

XDR correlation you can follow

Signals from email, endpoints, the network and identity are linked into one incident and shown as a chain, oldest first. Each step carries its ATT&CK technique and the entities involved, so an analyst can see how an attack progressed before deciding what to do.

  • Incidents built from signals across two or more sources, with the attack story rebuilt on demand
  • Entities, techniques and affected assets and identities on every incident
An XDR correlation in Ciyora Detect showing seven signals from four sources over 30 minutes: a phishing email, a document spawning PowerShell, command-and-control beaconing and LSASS memory access.An XDR correlation in Ciyora Detect showing seven signals from four sources over 30 minutes: a phishing email, a document spawning PowerShell, command-and-control beaconing and LSASS memory access.

SIEM and log search

Logs arrive from Ciyora collectors, the endpoint agent, Ciyora VPN and the other modules into one pipeline. Analysts search them by text, time range, severity and source, pivot on hosts and addresses, and see where ingest is healthy and where it is not.

  • Collectors receive syslog over UDP, TCP or TLS (RFC 3164 and RFC 5424) and tail files through log rotation
  • CEF, JSON and raw parsing, an on-disk buffer during outages, and compressed batches forwarded outbound over HTTPS
  • Ingest volume, events per source, alert trends and pipeline health
  • Search results exported as CSV

Detection coverage measured against ATT&CK

Detection rules use Sigma conditions, thresholds and multi-stage correlation. The coverage matrix shows which Enterprise ATT&CK techniques your enabled rules cover and which tactic is weakest, so you know where to invest.

  • Built-in Sigma rule templates tagged with ATT&CK, plus rules you write or tune yourself
  • Rule detail with the query, severity and mapped tactics and techniques; enable or disable in bulk
  • Coverage counted for enabled rules only, with an option to include disabled ones
The MITRE ATT&CK coverage page: 37 of 67 techniques covered, the weakest tactic named, and the three rules that cover T1059 Command and Scripting Interpreter.The MITRE ATT&CK coverage page: 37 of 67 techniques covered, the weakest tactic named, and the three rules that cover T1059 Command and Scripting Interpreter.

Behaviour analytics

Alongside rules, Detect learns a seven-day baseline for each user and raises anomalies when behaviour moves away from it. Insider-risk scoring brings the signals for one person together.

  • Activity spikes well above a person’s usual hourly volume
  • Sign-ins from a host the person has not used in the last seven days
  • Bursts of failed authentication

Endpoint detection and response

The Ciyora endpoint agent watches processes, memory, files and devices on Windows, macOS and Linux, and carries out response actions sent from the console. Analysts can investigate without a jump box.

  • Signature rules and indicator matching on the endpoint, kept in sync from the console
  • Memory scanning for injected code, shellcode, process hollowing and reflective loading
  • File integrity monitoring, vulnerability checks against NVD and tamper protection for the agent itself
  • Read-only live queries across endpoints with osquery SQL, and process trees with command lines and hashes
  • Response actions: isolate and release a host, kill a process, quarantine and restore a file, collect artifacts and control USB devices
A process tree node for powershell.exe launched by WINWORD.EXE on a finance workstation, showing the user, parent process, encoded command line and SHA-256 hash, with Kill process and Look up hash actions.A process tree node for powershell.exe launched by WINWORD.EXE on a finance workstation, showing the user, parent process, encoded command line and SHA-256 hash, with Kill process and Look up hash actions.

Threat intelligence

Feeds are synced and matched against your telemetry. Analysts search any indicator, including defanged ones, and see the verdict, source feed, confidence and where it appeared in your environment.

  • Feed management with sync now and enable or disable
  • Indicator search across IPs, domains, URLs, hashes, email addresses and CVEs
  • Matches against your logs and endpoints

Incidents, response and SOAR

Incidents have an owner, a status and a timeline of signals, notes and response actions. Response rules and playbooks automate the steps you trust; everything else is confirmed by a person and recorded.

  • Incident queue with bulk assignment and status changes
  • Response rules with run history, SOAR playbooks with ordered steps, and an IP and domain blocklist
  • AI triage that proposes a verdict for new alerts through Ciyora Neural Mesh
  • Threat hunts and forensic cases kept with their findings
  • On-call pages, alert triage and response actions on the Ciyora mobile app
Ciyora Detect

Capabilities

SIEM
Log search with time ranges, filters and pivots; events per source; ingest volume; pipeline health; alert trends; CSV export.
Collection
Ciyora collectors receive syslog over UDP, TCP or TLS and tail files, parse syslog, CEF and JSON, buffer to disk during outages and forward outbound over HTTPS. An ingest API accepts events from your own tools.
Detection rules
Sigma conditions, thresholds and multi-stage correlation, with built-in templates, severity, ATT&CK mapping and bulk enable or disable.
Behaviour analytics
Seven-day baselines for activity volume, new hosts and authentication failures, and insider-risk scoring.
XDR and incidents
Correlation across email, endpoint, network and identity; incident queue with status, severity and owner; timeline of signals, notes and response actions.
Threat intelligence
Feed management and sync, indicator search across IPs, domains, URLs, hashes, email addresses and CVEs, and matches against your telemetry.
Endpoint (EDR)
Signature and indicator matching, memory scanning, file integrity monitoring, live query, process trees and response actions through the Ciyora endpoint agent.
Response
Response rules with run history, SOAR playbooks with ordered steps, blocklists and AI triage, each automated step under your control.
Ciyora Fabric

How Ciyora Detect works with the rest of the platform

Every module shares one tenant, one identity model, one audit chain and one console, so a finding in one place is context everywhere else.

Ciyora Fortress

Identity threats from Fortress become signals in Detect incidents, and identities are one click away.

Ciyora Fortress

Ciyora Monitor

Endpoint activity and data-protection events from Ciyora Monitor add context to investigations.

Ciyora Monitor

Ciyora Discover

Every alert links to the asset, its software and its known vulnerabilities.

Ciyora Discover

Ciyora Neural Mesh

The alert-triage agent enriches new alerts and proposes a verdict and an owner.

Ciyora Neural Mesh

Ciyora Detect can be bought on its own or as part of a bundle. See Ciyora Detect pricing.

See Ciyora Detect in a demo

A demo walks through the module on a sample tenant and covers how it would connect to your identity provider, cloud accounts and sites.

Request a demoRead the docs