Your baseline report
A verdict on every enabled rule.
Find the rules that can’t fire. Get the evidence to fix them.
- Read-only
- No raw events
- The report is yours
Share your estateTell us your SIEM. Agree the estate inventory and issue a read-only token, or provide a one-time export.
An estate is the SIEM environment and deployed rule inventory we agree to assess together. Your first report is free.
Review the findingsWe walk through the results with your team in a findings session. Afterwards, you receive the full report: the checks applied, verdicts, supporting evidence and verification steps for your agreed estate.
Fix and recheckYour team fixes the dependencies. A fresh assessment shows which blockers are resolved.
A view of the results.
- CAN FIRE
- 759
- CANNOT FIRE
- 133
- INDETERMINATE
- 114
Dectyl-authored sample · 1,006 enabled, deployed, in-scope rules · Structural assessment
The public preview uses illustrative data. Your full technical report is shared after the findings session.
See the public previewSee a sample outcomeWhat counts as verification
See what changed.
Run another baseline after a fix or a change in your environment. Compare reports to see which findings are resolved and what still needs attention.
Know what you’re covered against.
Go beyond which rules can fire. See what to fix first and what you’d have caught.
Continuous opens after your second report.