A control room for two live websites.

Detection

What it catches

Turn a card over to see exactly when each rule fires.

• Brute forceT1110 · Brute ForceMany wrong passwords for one account: someone is guessing its password. How it's detectedFires when10 or more wrong passwords for one account within 10 minutes.First step: Check whether any sign-in for this account succeeded afterwards (Events, search the account).
• Credential stuffingT1110.004 · Credential StuffingOne IP trying many different accounts: someone is testing a leaked email/password list. How it's detectedFires whenOne IP fails on 5 or more different accounts within 10 minutes.First step: Look for any successful sign-in from this IP (Events, search the IP).
• Forged payment webhookT1565 · Data ManipulationA payment notification with a wrong signature: someone tried to fake a payment. How it's detectedFires whenAny payment notification whose signature doesn't match.First step: No order was changed: the signature check refused it.
• ScanningT1595 · Active ScanningRequests for files the site doesn't have (/.env, /wp-admin…): a bot looking for weaknesses. How it's detectedFires whenAny request for a scanner path; medium once one IP asks for 5 in 5 minutes.First step: Usually harmless noise, but check none of the paths returned 200.
• Request floodT1499 · Endpoint Denial of ServiceOne IP hit the rate limit 50 times in a minute: an attempt to overload the site. How it's detectedFires whenOne IP hits the rate limit 50 times within a minute.First step: The rate limit is doing its job; check the site stayed responsive.
• Sign-in from a new IPT1078 · Valid AccountsA successful sign-in from an IP this account hasn't used in 30 days: maybe a stolen password. How it's detectedFires whenA sign-in from an IP the account hasn't used in 30 days.First step: Often it's just a new phone or Wi-Fi. If unsure, ask the account owner.

Pipeline

How it works

1. 1Signed eventsEach site sends what happened (failed sign-ins, scans, forged payments), signed with its own secret. Unsigned, changed or replayed requests are refused.
2. 2Detection rulesSix rules mapped to MITRE ATT&CK look for patterns across events: per account, per IP or per site.
3. 3AlertsOne alert per attack, with evidence, advice and a timeline. High alerts also send an email. Visitors never wait for any of it.