Platform Features

Bring an AI teammate to
the SIEM you already run.

An assistant that can take any SIEM action, rule suggestions verified against your data, an ATT&CK coverage map, insights into broken rules and the SIEM itself, drafts for every change, Terraform export, and AI workflows on a schedule. All self-hosted.

The Platform

A connected workspace for SIEM operations.

Investigate with an assistant that can act, add the rules you are missing, see your ATT&CK coverage, catch broken rules early, and keep every change behind a review step.

Agent Assistant · Any SIEM action

One assistant, docked beside every page.

Ask about your data, or ask for a change. The assistant knows which rule, dashboard, system, insight, or workflow you are looking at, writes the provider-specific query, and turns every proposed change into a card you approve, reject, or move to draft.

  • ✓Runs searches on Splunk, Elastic, and Snowflake and shows the exact query next to the answer
  • ✓Creates and edits rules, dashboards, systems, Splunk apps, insights, skills, and workflows
  • ✓Every change needs approval, destructive actions are always gated, and read-only users cannot change anything
Assistant · docked beside every pageIllustrative data
Context: Rule · Suspicious PowerShell downloadSkill: Identity triage
Exclude svc_backup from this rule and add an email alert action.
✓ Validated the search against index=endpoint✓ Prepared 2 changes
Update ruleNeeds approval
  • + user!=svc_backup
  • + Alert action: email soc@acme.example
ApproveRejectMove to draft

Rule Suggestion · Detection Engineering

Your next rules, already written.

SIEMate profiles each system from the data it sends, matches it against the SIEMateRules catalog, and recommends the detections you are missing. Each suggestion arrives verified: converted for your SIEM, field-checked against your knowledge base, and run once before you see it.

  • ✓Nightly pipeline: catalog sync, tag matching, relevance pass, duplicate check, and verification with a high, medium, or low level
  • ✓An activity check labels each suggestion quiet, normal, or noisy before you add it
  • ✓Tailored suggestions drafted from your own telemetry, using aggregate evidence only
  • ✓Nothing is deployed until you create the rule. Critical catalog rules raise a priority insight within 15 minutes
Rules · Suggestions · 4 readyIllustrative data
+
Okta: MFA fatigue push bombing
Okta · verified, converted, run once
HIGHnormal
+
Windows: Encoded PowerShell command
Windows Security · verified, converted, run once
HIGHquiet
+
AWS: IAM access key created for root
AWS CloudTrail · verified, converted, run once
MEDIUMquiet
+
Okta: Impossible travel sign-in
Okta · verified, converted, run once
HIGHnoisy
Nightly: catalog sync · match · dedup · verify · activity checkNothing deploys until you create it

Attack Coverage Map · MITRE ATT&CK

Beta

Every technique you cover. Every one you don't.

A MITRE ATT&CK Enterprise matrix judged per system. Each technique is Covered, Suggested, a Detectable gap, a Blind spot, or Out of scope, so the score reflects what your environment can actually see rather than a generic checklist.

  • ✓Heatmap and grid views, search by technique, and filters by bucket and system
  • ✓Open a technique to see the rules that detect it and create a ready suggestion from the same panel
  • ✓Mappings come from the catalog, the rule text, or AI; low-confidence mappings go to a review queue for a human decision
Rules · ATT&CK Coverage · BetaIllustrative data
64%of in-scope techniques covered
31 everywhere · 9 partial · 12 review
Initial Access
Execution
Persistence
Priv. Esc.
Defense Evasion
Cred. Access
Lateral Mvmt
Exfiltration
CoveredSuggestedDetectable gapBlind spotOut of scope

Insights · Rule Health

Catch rule problems before they bite.

A daily rule-health refresh scores every alert and report: silent, spiking, sustained noise, firing with no action, or stopped. The worst are escalated to the agent, which gathers evidence first and then opens an insight with a priority from 1 to 5.

  • ✓Fix with SIEMate proposes the change in chat. Nothing changes until you approve it
  • ✓Ask SIEMate walks through the fix without touching anything
  • ✓Insights close themselves once the fix works, and unused reports get their own tab
Insights · RulesIllustrative data
P1
Rule stopped firing after sourcetype rename
rule_modify
Fix with SIEMate
P2
Alert fires 400x per day with no action attached
rule_review
Open
P3
Catalog updated: Okta session hijack logic changed
catalog_rule_update
Open
P4
Report not referenced, scheduled, or run in 90 days
rule_disable
Dismissed
Daily rule-health refresh · evidence gathered first · nothing changes until you approve

Internal Insights · SIEM Health

Know when the SIEM itself is the problem.

A nightly scan reads the SIEM's own internal, audit, and introspection logs plus the bulletin board, groups recurring problems into findings, and queues one agent investigation per new finding. Problems that belong to one rule are filed on that rule instead.

  • ✓Scheduler, search errors, alert actions, inputs, license, KV store, capacity, audit, and access findings
  • ✓Sources SIEMate cannot read raise their own finding, which clears once access is granted
  • ✓A Self-Diagnostics tab reports SIEMate's own failures and access gaps. Splunk today, with other providers planned
Insights · Splunk HealthIllustrative data
_internal·_audit·_introspection·bulletin
Scheduler skipped 38 searches at peak load
scheduler
recurring
Alert action failed: SMTP relay refused connection
alert_action
new
KV store approaching lookup size limit
kvstore
recurring
HEC input dropped events: queue full
input
clearing

Drafts · Review Before It Exists

Nothing is created until you say so.

Every change the assistant proposes becomes a card you approve, reject, or move to draft. A draft opens in the rule editor unsaved, where the assistant keeps patching the on-screen version while every save tool stays blocked.

  • ✓Flip between versions of the draft with the Assistant changes arrows
  • ✓Every AI edit is recorded as a revision you can revert, one at a time or all changes after a message
  • ✓Rule suggestions open as drafts too. Nothing is saved until you click Create
Rule editor · Draft (unsaved)Illustrative data
Encoded PowerShell commandDRAFT
Assistant changes‹2 / 2›Revert this change
index=endpoint EventCode=4688
| regex CommandLine="(?i)(powershell|pwsh).*(-enc|-e|-ec)\s"
| stats count by host, user
Save tools blocked while draftingCreate rule

Terraform Environment · Configuration as Code

Beta

Generate Terraform. Never apply directly.

Switch a workspace to Terraform management and SIEMate stops writing to your SIEM. Rules, dashboards, and Splunk apps are rendered into Terraform files that follow your repository layout, ready for your own review and pipeline.

  • ✓Templates written by hand or drafted by AI from one or two sample files out of your repository
  • ✓Optional terraform init and validate in an isolated runner with no secrets, no network egress, and a read-only filesystem
  • ✓Convert from the rules list, rule editor, suggestion draft, system page, dashboard, or chat, and download a bundle with a report
Convert to Terraform · BetaIllustrative data
rules/okta_mfa_fatigue.tf
rules/encoded_powershell.tf
dashboards/identity_overview.tf
apps/siemate_detections.tf
Template: acme-detections-repo
resource "splunk_saved_searches" "okta_mfa_fatigue" {
  name     = "Okta: MFA fatigue"
  search   = local.okta_mfa_fatigue
  cron_schedule = "*/15 * * * *"
  actions  = "email"
}
✓ terraform fmt✓ terraform init✓ terraform validate
Nothing changes in the SIEM

AI Workflows · Dynamic Detections

Put a skill on a schedule.

A workflow pairs a skill (persona, know-how, and allowed tools) with a plain-language task and a cron schedule. Ask the assistant to create one, approve the card, and every run is saved as a chat you can read later. Findings flow into insights with proposed rule changes you approve.

  • ✓Run on a schedule or on demand with Run now
  • ✓Scheduled runs read, search, and report on their own. Anything that needs approval waits for a person
  • ✓Keep detections current: rule health, catalog update notices, and workflow findings all end in a proposed change you review
AI WorkflowsIllustrative data
Bank Activity MonitorRUNNING
Every 6 hours·Banking Fraud Analyst
Daily Cloud Posture ReviewIDLE
On demand·Cloud Security Specialist
Identity Threat HuntDISABLED
Weekly, Mon 8am·Identity Protection Expert

Also in the workspace

Everything the eight capabilities build on.

Dashboards

Metrics, charts, tables, event lists, and maps built from a description, with export to the SIEM.

Systems

Each product sending data (Okta, AWS, Windows) identified from the data alone, with its logs and rules grouped under it.

Knowledge base

Fields, datasets, and metadata indexed from the SIEM and used as context for every query the assistant writes.

Skills and memories

Reusable know-how the assistant applies per chat, plus facts it remembers about your environment.

Scheduled actions

Built-in platform actions on a cron schedule, separate from AI workflows.

Workspaces and roles

Isolated workspaces with owner, manager, and developer roles, SSO, and per-user AI budgets.

See how SIEMate fits your security workflow.

Explore the guided tour with illustrative data, then request a live session to discuss your environment and requirements.

Request a DemoExplore the Product

siemate.com