See everything. Control everything. No black-box AI.
Immutable audit trails. Full visibility into AI suggestions. Every feature toggleable, with white-label branding for regulated and MSSP deployments. Deploy on your terms: SaaS or a single air-gapped binary.
Risk Posture
Know your exposure before the board asks
Detection coverage mapped to business services and MITRE techniques you actually face, not a generic heatmap. Silently broken rules surfaced the day they stop firing. Every blind spot has a name.
Exposure, quantified
Threat-weighted coverage score across your attack paths. One number, drillable to the specific techniques driving it.
Silently broken rules
Industry data says only 5% of deployed detections actually work. We flag the dead ones in real time, so a rule count never gives false comfort again.
Board-ready metrics
MTTD, MTTR, noise rate, and MITRE coverage trending over time. Exportable. No spreadsheet archaeology the night before the meeting.
Everything toggleable
Feature flags for AI, hunts, threat model, and threat feed. White-label branding for regulated and MSSP deployments. SSO, Passkey MFA, and RBAC included.
AI Governance
AI that assists, never acts
Unlike black-box platforms that automatically tune your detections, CraftedSignal keeps humans in control. AI suggests improvements. Your team reviews and approves. Nothing deploys without explicit authorization.
- All AI suggestions require human approval before deployment
- Self-host AI via Ollama so your data never leaves your infrastructure
- Disable AI entirely if your policy requires it
- Full audit trail of every AI interaction and decision
Suggested: Add process lineage check to webshell detection
Reduces false positives by 40% based on analysis of last 30 days
Governance Resources
Deep-dive into the security model
Security & Compliance
Data boundaries, encryption, audit logging, SSO, and compliance posture (SOC2, NIS2, GDPR).
Secure Workflows
Validation, testing, approval gates, monitoring mode, and rollback at every stage of the detection lifecycle.
Roles & Permissions
RBAC matrix with Admin, User, and Viewer roles. Separation of duties enforced by the platform.
Deployment Guide
SaaS, self-hosted, and air-gapped options. Single binary, outbound-only agents, local AI.
Deployment
Deploy on your terms
SaaS
Managed by CraftedSignal. Automatic updates, zero infrastructure overhead. Your logs never leave your SIEM, we manage rules and metadata only.
Self-hosted
Single binary, no external dependencies. SQLite built in, optional PostgreSQL. Run AI locally via Ollama. You control upgrades, backups, and availability.
Air-gapped
Full functionality with no internet access. AI via local Ollama, all features offline. Agents are outbound-only, no inbound ports required.
Not your role?
Detections as code, live SIEM testing, CLI-first workflow
SOC LeadersMITRE coverage, noise dashboards, ROI calculator
In-House SOCGoverned deploys, noise budgets, multi-SIEM parity
MSSPs & MDRsMulti-tenant waves, delegated RBAC, fleet health
Regulated EUGDPR/NIS2 mapping, EU-first deployment, compliance packs