detections.ai

Announcing AI Assistant! Our agentic tooling just got a major upgrade. What makes it different is the data it’s grounded in - language grammar, tens of thousands of detections and intel reports, and 14,000 real-world users. On top of that, dozens of tools custom built for detection engineering, not generic chat. Here are two highlights: Ask in plain English - it searches everywhere."What are the most popular lateral movement community detections in the last month that I don't have in my personal library?" AI Assistant will search your personal workspace, groups, community and the web if you ask. Consider it your AI librarian for finding and answering any questions about detections. Turns any threat context into detections. Drop in a CISA advisory, a community intel report, PoC code, logs and more. AI Assistant will analyze across multiple sources to build out opportunities, identify detections that already exist, and build detections for you across 9 different languages. Community built, AI Assisted - now with more DE agentic tools It’s live now, give it a shot and share your feedback!

🔐 Collaboration just got easier for detection engineers! Check out our latest walkthrough on Groups — one of the most powerful features on detections.ai for team collaboration and knowledge sharing. What you'll learn: ✅ Creating custom groups with tailored privacy settings ✅ Managing permissions and member access ✅ Discovering and joining public community groups ✅ Sharing detections directly within your team or the broader community Whether you're coordinating with your internal security team or tapping into the collective expertise of 10,000+ community detections, Groups help you organize workflows, close coverage gaps, and build better detections together. Ready to level up your detection engineering collaboration? More tips and tricks can be found on YouTube channel - @detectionsai - https://lnkd.in/gnu5ZVRv Watch the full video and start building your group today! 👇 Thanks for the walkthrough Tim Peck

⭐ Community Spotlight: Georg Lauenstein ⭐ Shoutout to one of our top contributors, Georg L., for delivering another exceptional YARA-L detection! Latest Rule: MuddyWater VBA Dropper Detection Georg's newest rule targets MuddyWater APT activity by detecting the creation and execution attempts of C:\ProgramData\CertificationKit.ini — a known staging path used in their VBA dropper campaigns. What makes this detection stand out: -Correlates file creation with suspicious cmd.exe execution - Short time-window analysis for high-fidelity alerting -Built for Google SecOps (Chronicle) -Addresses real-world APT tradecraft This rule is now live in our new SecOps Signals group — join the group to access this and other Google SecOps-focused detections! Check out the rule: https://lnkd.in/g4D2FeET This is what community-driven detection engineering looks like. Thanks for leveling up our collective defense, Georg! #DetectionEngineering #ThreatIntel #MuddyWater #APT #GoogleSecOps #Chronicle #YARAL #Cybersecurity #ThreatHunting #DetectionsAI

Great read by Harrison P. on a challenge many in cybersecurity face: turning threat intelligence into actionable detection outcomes. We've all heard 'intel without detection is just storytelling.' This article explores bridging that gap, highlighting how detections.ai is using AI to: • Analyze and summarize intel reports (from blogs to 50-page docs) • Score reports based on their value for detection development • Automatically generate tailored detection recommendations The goal is to drastically cut the time it takes to get from receiving new intelligence to having reviewable, actionable detection logic. It’s about moving from 'knowledge' to 'execution' more efficiently. Check out the full article here: https://lnkd.in/girzHVYs

detections.ai has added support for the MITRE ATT&CK® framework for our library management. Free for all our users - this gives everyone a chance to see where they are missing coverage and use the incredible shared detections from the community to help fill the gaps. If you want to join the community and check out the new library management - please use Invite Code "MITRE" to join @ https://detections.ai/

🎬 Missed our "Threat Intel to Detection Rules" webinar? We've got you covered. Thanks to everyone who joined us across APAC, EMEA, and Americas sessions! The energy and questions from the detection engineering community were incredible and made for a great global event. Couldn't make it? The full recording is now on our YouTube channel (https://lnkd.in/gnu5ZVRv), along with: Complete demo walkthrough Q&A sessions from all three regions Some highlights from the sessions 🎥 : → Live demo converting CVE reports into deployable detection rules → AI agents generating cross-platform detections in real-time → Community validation and collaboration workflows → Strategies for eliminating threat intel overload Watch the recording(s) here. https://lnkd.in/gnu5ZVRv Big thanks to Aaron Mog & Tim Peck for delivering such valuable insights, and to our community of 8,000+ detection engineers who continue to push the field forward. Ready to turn intel into impact? Join detections.ai using invite code "Community" and start turning threat intel into detections today.