https://craftedsignal.io/SOC Control Plane for risk-scored detection workHugoenhttps://craftedsignal.io/favicon-32x32.pnghttps://craftedsignal.io/3232https://craftedsignal.io/favicon.svghttps://craftedsignal.io/docs/getting-started/https://craftedsignal.io/docs/getting-started/Install CraftedSignal (SaaS or self-hosted), connect your SIEM, import rules, add business context, work the Backlog, and deploy your first tested rule in minutes with csctl.https://craftedsignal.io/compare/native-siem-rules/https://craftedsignal.io/compare/native-siem-rules/Compare CraftedSignal with the status quo: detection rules managed directly inside native SIEM consoles, scripts and ad hoc repositories.https://craftedsignal.io/docs/configuration/https://craftedsignal.io/docs/configuration/Complete YAML configuration reference for CraftedSignal covering HTTP, storage, security, Temporal, AI, email, logging and production hardening options.https://craftedsignal.io/docs/cli/https://craftedsignal.io/docs/cli/Full reference for csctl, the CraftedSignal CLI. Covers commands for init, validate, push, pull, sync, diff, library management, and CI/CD integration.https://craftedsignal.io/docs/rules/https://craftedsignal.io/docs/rules/How detection rules are structured in CraftedSignal: metadata, MITRE ATT&CK mapping, multi-platform implementations, lifecycle states, versioning, and dependencies.https://craftedsignal.io/docs/library/https://craftedsignal.io/docs/library/Reusable rule and hunt templates with tests, ATT&CK mapping, runbooks, playbooks, comments, imports, and managed source repositories.https://craftedsignal.io/docs/testing/https://craftedsignal.io/docs/testing/Test detection rules with positive, negative, and enrichment tests run against your live SIEM. Covers validation, CI/CD pipelines, and continuous monitoring.https://craftedsignal.io/docs/deployment/https://craftedsignal.io/docs/deployment/Deploy detection rules to Splunk, Sentinel, CrowdStrike, and Rapid7 with approval workflows, dry-run previews, atomic rollback, and drift detection.https://craftedsignal.io/docs/groups/https://craftedsignal.io/docs/groups/Organize rules into deployable groups with targets, quality status, approval policy, batch deployment, CSV export, and health tracking.https://craftedsignal.io/docs/runbooks-playbooks/https://craftedsignal.io/docs/runbooks-playbooks/Attach Markdown runbooks and playbooks to rules, hunts, library entries, and threat briefs. Keep response steps synced with rule changes and generated drafts.https://craftedsignal.io/docs/hunts/https://craftedsignal.io/docs/hunts/Hypothesis-driven hunts that fan out across every connected SIEM. Cluster results, verdict them in batch, attach runbooks and playbooks, and promote winning queries to tested Sigma detections with a full audit trail.https://craftedsignal.io/docs/health-analytics/https://craftedsignal.io/docs/health-analytics/Monitor detection health with MITRE ATT&CK coverage heatmaps, noise budgets, signal-to-noise ratios, team workload metrics, MTTR and ROI tracking dashboards.https://craftedsignal.io/docs/risks/https://craftedsignal.io/docs/risks/The Risk Ops Board turns each company attack path into a tracked risk with a state machine, priority score, and lifecycle audit trail. Hunt, accept residual, escalate, or schedule a re-hunt — the loop closes back into coverage.https://craftedsignal.io/docs/threat-model/https://craftedsignal.io/docs/threat-model/Model business services, declare attack paths, and score every MITRE technique by the exposure it represents to your organization. Accepted paths become tracked risks with a full lifecycle.https://craftedsignal.io/docs/ai/https://craftedsignal.io/docs/ai/AI-assisted detection engineering: rule generation, runbook and playbook drafts, translation linting, health insights, and autofix. Self-hosted via Ollama with full data privacy and human approval.https://craftedsignal.io/docs/threat-actors/https://craftedsignal.io/docs/threat-actors/A normalized catalog of threat groups linked to briefs, risks, detections, and hunts. Seeded from MITRE ATT&CK and grown automatically by an LLM that adjudicates names from incoming intel.https://craftedsignal.io/docs/threat-feed/https://craftedsignal.io/docs/threat-feed/Curated threat briefs with Sigma rules, IOCs, runbooks, playbooks, MITRE mappings, affected products, and per-tenant relevance scoring. Briefs answer whether the threat affects you, whether you can see it, and whether you are covered.https://craftedsignal.io/docs/dfend/https://craftedsignal.io/docs/dfend/MITRE D3FEND integration: how CraftedSignal maps your active detections to defensive techniques across the Detect, Harden, Isolate, Deceive, and Evict categories — and how gaps feed the hunt proposer.https://craftedsignal.io/docs/drift/https://craftedsignal.io/docs/drift/Every deployed rule is re-hashed on a schedule. Any out-of-band change in the SIEM is flagged, diffed, and queued for review.https://craftedsignal.io/docs/secure-workflows/https://craftedsignal.io/docs/secure-workflows/Secure detection workflows with mandatory validation, automated SIEM testing, approval gates, atomic rollback, drift detection, and breakglass emergency procedures.https://craftedsignal.io/docs/threat-intake/https://craftedsignal.io/docs/threat-intake/SOC triage queue for candidate threats from CTI, risk requests, Threats, and future exposure or vulnerability sources.https://craftedsignal.io/docs/approvals/https://craftedsignal.io/docs/approvals/Review rule changes before deployment with query diffs, metadata, tests, projected impact, noise budget context, multi-approver policy, and audit history.https://craftedsignal.io/docs/backlog/https://craftedsignal.io/docs/backlog/A single risk-scored work queue for threats, coverage gaps, missing telemetry, rule tuning, broken rules, tests, mappings, approvals, findings, and residual-risk decisions.https://craftedsignal.io/compare/anvilogic/https://craftedsignal.io/compare/anvilogic/Compare CraftedSignal and Anvilogic for detection engineering, SOC automation workflows, evidence, deployment control and detection lifecycle governance.https://craftedsignal.io/docs/noise-budgets/https://craftedsignal.io/docs/noise-budgets/Set daily alert budgets per team, service, or rule. Deploys that would blow the budget are held. Monitoring mode proves volume out before alerts reach analysts.https://craftedsignal.io/solutions/risk-modeling/https://craftedsignal.io/solutions/risk-modeling/Turn business services, crown-jewel data, attack paths, threats and findings into risk-scored detection priorities your SOC can defend.https://craftedsignal.io/docs/roles-permissions/https://craftedsignal.io/docs/roles-permissions/Role-based access control with Owner, Admin, User, and Viewer roles. Covers separation of duties, permission matrix, SSO/OIDC, passkey MFA, and instance claiming.https://craftedsignal.io/docs/ai-quality/https://craftedsignal.io/docs/ai-quality/Track AI operation volume, first-pass rate, quality scores, retries, errors, hot rules, trends, and improvement proposals.https://craftedsignal.io/docs/api/https://craftedsignal.io/docs/api/CraftedSignal REST API reference for CI/CD integration: lint, test, deploy, rollback, approval workflows, health metrics, and rate limits by pricing tier.https://craftedsignal.io/docs/git-backup/https://craftedsignal.io/docs/git-backup/Push every rule, version, and test to your Git repository on a schedule. Restore from any point, audit offline, or migrate environments without touching the SIEM.https://craftedsignal.io/docs/simulations/https://craftedsignal.io/docs/simulations/Run attack simulations from the CLI, report results to the platform, correlate detections, bind scenarios to rules, and track simulated coverage gaps.https://craftedsignal.io/docs/airgapped/https://craftedsignal.io/docs/airgapped/Run the platform with all outbound network access blocked, including DNS. For regulated and isolated environments where the platform must not reach the internet.https://craftedsignal.io/docs/platforms/https://craftedsignal.io/docs/platforms/Platform integration guides for Splunk (SPL), Microsoft Sentinel (KQL), CrowdStrike (IOA), and Rapid7 InsightIDR (LEQL) with setup, credentials, and multi-SIEM deployment.https://craftedsignal.io/docs/security/https://craftedsignal.io/docs/security/CraftedSignal security architecture: data boundaries, AES-256 encryption with per-tenant keys, hardened GCP infrastructure, audit logging, SSO/MFA and supply-chain security.https://craftedsignal.io/docs/targets-mappings/https://craftedsignal.io/docs/targets-mappings/Connect SIEM targets, keep read-only or auto-sync settings, manage field mappings, log source mappings, and apply suggested overrides.https://craftedsignal.io/docs/cloud-sovereignty/https://craftedsignal.io/docs/cloud-sovereignty/Cloud sovereignty options for CraftedSignal: secured SaaS, customer-controlled keys, Confidential Space attestation, encrypted memory, private cloud and fully air-gapped deployments.https://craftedsignal.io/docs/pricing/https://craftedsignal.io/docs/pricing/Compare CraftedSignal pricing tiers: Free, Professional, Enterprise, and Unlimited. See rule limits, SIEM connections, API quotas, and self-hosted licensing.https://craftedsignal.io/compare/cardinalops/https://craftedsignal.io/compare/cardinalops/Compare CraftedSignal and CardinalOps for detection posture management, ATT&CK coverage, detection health, approvals, deployment and evidence.https://craftedsignal.io/solutions/threat-intelligence/https://craftedsignal.io/solutions/threat-intelligence/Convert threat briefs, IOCs, Sigma rules, CVEs and ethical hack findings into risk-scored Backlog work, hunts and detections.https://craftedsignal.io/compare/cymulate/https://craftedsignal.io/compare/cymulate/Compare CraftedSignal and Cymulate for exposure validation, breach and attack simulation, detection engineering and operationalizing validation findings.https://craftedsignal.io/solutions/threat-hunting/https://craftedsignal.io/solutions/threat-hunting/Run hypothesis-driven hunts across SIEMs, cluster the hits, verdict the result and promote what works.https://craftedsignal.io/compare/picus/https://craftedsignal.io/compare/picus/Compare CraftedSignal and Picus for exposure validation, breach and attack simulation, detection validation, remediation workflow and detection engineering evidence.https://craftedsignal.io/solutions/detection-health/https://craftedsignal.io/solutions/detection-health/Catch dead rules, noisy rules, drift, failing tests, missing telemetry and weak mappings before they become blind spots.https://craftedsignal.io/compare/attackiq/https://craftedsignal.io/compare/attackiq/Compare CraftedSignal and AttackIQ for breach and attack simulation, security control validation, detection engineering remediation and detection evidence.https://craftedsignal.io/solutions/detection-workflows/https://craftedsignal.io/solutions/detection-workflows/Write, test, approve, deploy, and roll back detections with the same discipline teams expect from software delivery.https://craftedsignal.io/compare/soc-prime/https://craftedsignal.io/compare/soc-prime/Compare CraftedSignal and SOC Prime for detection content, Sigma rules, AI-assisted authoring, threat intelligence, governance, deployment and evidence.https://craftedsignal.io/solutions/platform-operations/https://craftedsignal.io/solutions/platform-operations/Run CraftedSignal as SaaS, self-hosted, or air-gapped with hardened GCP infrastructure, multi-tenant controls, APIs, CLI, SSO, and optional local generation.https://craftedsignal.io/compare/panther/https://craftedsignal.io/compare/panther/Compare CraftedSignal and Panther for modern SIEM workflows, detection-as-code, investigation, log analytics, deployment control and detection governance.https://craftedsignal.io/compare/snapattack/https://craftedsignal.io/compare/snapattack/Compare CraftedSignal and SnapAttack for threat-informed detection engineering, adversary emulation, detection content, validation, deployment governance and evidence.https://craftedsignal.io/compare/elastic-security/https://craftedsignal.io/compare/elastic-security/Compare CraftedSignal and Elastic Security for SIEM modernization, detection content, detection engineering governance, deployment control and evidence.https://craftedsignal.io/for/cisos/https://craftedsignal.io/for/cisos/Runtime detection risk, audit trails, governed generation, cloud sovereignty options, KMS-backed encryption and deployable SaaS, private-cloud or air-gapped models.https://craftedsignal.io/for/detection-engineers/https://craftedsignal.io/for/detection-engineers/Built for engineers who treat detections as codehttps://craftedsignal.io/for/in-house-soc/https://craftedsignal.io/for/in-house-soc/Ship governed detections without breaking prodhttps://craftedsignal.io/for/mssps/https://craftedsignal.io/for/mssps/Multi-tenant detection rollouts with guardrails and delegated controlhttps://craftedsignal.io/for/regulated-eu/https://craftedsignal.io/for/regulated-eu/Audit-ready detection governance with EU-first deployment choiceshttps://craftedsignal.io/for/soc-leaders/https://craftedsignal.io/for/soc-leaders/Ship detections with confidence. Rollback in seconds.https://craftedsignal.io/privacy/https://craftedsignal.io/privacy/How CraftedSignal handles your data.https://craftedsignal.io/terms/https://craftedsignal.io/terms/Terms governing your use of CraftedSignal.https://craftedsignal.io/trust/https://craftedsignal.io/trust/Why you can trust CraftedSignal: raw logs stay in your SIEM, derived detection statistics are stored in CraftedSignal, AES-256 per-tenant encryption, hardened GCP infrastructure, immutable audit trails, independent security testing, SBOMs, signed artifacts and SaaS, self-hosted, or air-gapped deployment.