Skip to main content
Ciyora Detect

From raw events to a correlated incident

Ciyora Detect brings logs, endpoint telemetry and identity signals into one pipeline. Detection rules are mapped to MITRE ATT&CK, related signals are stitched into incidents, and analysts can query endpoints, inspect process trees and run response actions without leaving the console.

Request a demoRead the Ciyora Detect docs
A critical incident in Ciyora Detect, credential theft and lateral movement from a finance workstation, with owner, detection sources across email, endpoint, network and identity, affected assets and identities, and the ATT&CK techniques involved.A critical incident in Ciyora Detect, credential theft and lateral movement from a finance workstation, with owner, detection sources across email, endpoint, network and identity, affected assets and identities, and the ATT&CK techniques involved.

What Ciyora Detect does

XDR correlation you can follow

Signals from email, endpoints, the network and identity are linked into one incident and shown as a chain, oldest first. Each step carries its ATT&CK technique and the entities involved, so an analyst can see how an attack progressed before deciding what to do.

An XDR correlation in Ciyora Detect showing seven signals from four sources over 30 minutes: a phishing email, a document spawning PowerShell, command-and-control beaconing and LSASS memory access.An XDR correlation in Ciyora Detect showing seven signals from four sources over 30 minutes: a phishing email, a document spawning PowerShell, command-and-control beaconing and LSASS memory access.

Detection coverage measured against ATT&CK

Detection rules use Sigma conditions, thresholds and multi-stage correlation. The coverage matrix shows which Enterprise ATT&CK techniques your enabled rules cover and which tactic is weakest, so you know where to invest.

  • Import rules from open community rule sets, then enable, disable or tune them
  • Rule detail with the query, severity and mapped tactics and techniques
  • Coverage counted for enabled rules only, with an option to include disabled ones
The MITRE ATT&CK coverage page: 37 of 67 techniques covered, the weakest tactic named, and the three rules that cover T1059 Command and Scripting Interpreter.The MITRE ATT&CK coverage page: 37 of 67 techniques covered, the weakest tactic named, and the three rules that cover T1059 Command and Scripting Interpreter.

Endpoint investigation without a jump box

From the console, analysts can run read-only live queries across endpoints, walk a process tree with command lines and hashes, look up a hash against threat intelligence, and stop a malicious process after confirming the action.

A process tree node for powershell.exe launched by WINWORD.EXE on a finance workstation, showing the user, parent process, encoded command line and SHA-256 hash, with Kill process and Look up hash actions.A process tree node for powershell.exe launched by WINWORD.EXE on a finance workstation, showing the user, parent process, encoded command line and SHA-256 hash, with Kill process and Look up hash actions.
Ciyora Detect

Capabilities

SIEM
Log search with time ranges, filters and pivots; events per source; ingest volume; pipeline health; alert trends.
Collection
Ciyora collectors receive syslog over UDP, TCP or TLS and tail files, parse syslog, CEF and JSON, buffer to disk during outages and forward outbound over HTTPS.
Detection rules
Sigma conditions, thresholds and multi-stage correlation, with severity, ATT&CK mapping and bulk enable or disable.
Incidents
Queue with status, severity and owner; timeline of signals and response actions; linked entities and techniques.
Threat intelligence
Feed management and sync, indicator search across IPs, domains, URLs, hashes, email addresses and CVEs, and matches against your telemetry.
Endpoint (EDR)
Live query with read-only osquery SQL, process trees, hash look-up and kill-process response through the Ciyora endpoint agent.
Response
Response rules with run history and SOAR playbooks with ordered steps, each run confirmed and recorded.
Behaviour analytics
Baselines for sign-in volume, new hosts and authentication bursts that raise anomalies alongside rule-based alerts.
Ciyora Fabric

How Ciyora Detect works with the rest of the platform

Every module shares one tenant, one identity model, one audit chain and one console, so a finding in one place is context everywhere else.

Ciyora Fortress

Identity threats from Fortress become signals in Detect incidents, and identities are one click away.

Ciyora Fortress

Ciyora Monitor

Endpoint activity and data-protection events from Ciyora Monitor add context to investigations.

Ciyora Monitor

Ciyora Discover

Every alert links to the asset, its software and its known vulnerabilities.

Ciyora Discover

Ciyora Neural Mesh

The alert-triage agent enriches new alerts and proposes a verdict and an owner.

Ciyora Neural Mesh

Ciyora Detect can be bought on its own or as part of a bundle. See Ciyora Detect pricing.

See Ciyora Detect in a demo

A demo walks through the module on a sample tenant and covers how it would connect to your identity provider, cloud accounts and sites.

Request a demoRead the docs