Follow tl;dr
Prime Detect runs detection rules on your clients’ event streams before data reaches the SIEM. It applies Sigma rules to events in transit, tags each match with a severity and a MITRE ATT&CK technique, and links related matches into attack chains. In client testing, about 7% of telemetry was tagged.
MSSPs use Prime Detect to give every client the same 20,000+ detections regardless of which SIEM that client runs, to send less data into SIEMs they pay to operate, and to keep each client’s data inside its own pipeline. It works alongside the SIEMs you already run. It does not replace them.
Why MSSPs are moving detection ahead of the SIEM
An MSSP’s detection coverage is usually set by whatever each client’s SIEM can hold. That creates three problems that grow with every client you add.
- Uneven coverage. Clients run different SIEMs with different rule limits. The same threat can be caught for one client and missed for another, depending on the platform underneath.
- Ingest cost. Where you operate the SIEM, every event ingested is a cost against your margin, whether it carries a threat signal or not.
- Engineering load. Your detection engineers spend their time porting and tuning the same rules across platforms instead of building the detections clients actually pay for.
Prime Detect moves detection upstream. Rules run on events as they stream through the pipeline, before any SIEM ingests them. Coverage depends on the compute you assign, not on each client’s SIEM. You then decide, per client, what reaches the SIEM.
What Prime Detect does
Detection in the stream
- Applies Sigma rules to events in transit, before SIEM ingest
- Runs 20,000+ detection rules plus your own custom detections, with no fixed rule ceiling
- Tags every match with a severity and a MITRE ATT&CK technique
- Links related matches into attack chains, so analysts see a sequence of activity instead of isolated alerts
Tagged telemetry you can route
- Tags about 7% of telemetry, based on client testing
- Sends tagged events to the SIEM and the rest to warm or cold storage, by your rules
- Produces structured, ATT&CK-labeled events that AI triage and SOAR tools can use directly
Deployment and control
- Runs on Kafka and Kubernetes you or your clients operate
- Keeps data inside the pipeline, with no outbound connection required
- Deploys air-gapped or in the cloud
- Available open source or under an Enterprise license
How it fits with the SIEMs you already run
Prime Detect sits between the event pipeline and the SIEM. Nothing in the SIEM has to change, so it works across a mixed client base.
MSSPs typically deploy it in one of two ways:
- Shared, multi-tenant: one Prime Detect deployment in your environment, with detections and routing set per tenant.
- Per client: a deployment inside the client’s own infrastructure, for clients with strict data residency or air-gap requirements.
Rollout follows the same three steps either way:
- Forward everything to the SIEM as today, with Detect tags added to matched events.
- Add a SIEM index or dashboard that raises Detect-tagged events as high-priority alerts.
- Once tuned, route untagged events to warm or cold storage to cut ingest.
What Prime Detect does not do
- It does not replace the SIEM for centralized logging, search, investigation, or retention.
- It does not decide whether an incident is significant or reportable. Your incident process makes that call.
- It does not make data transfer decisions for you. Where data goes, and under which agreement, stays with your firm and your clients.
NIS2, DORA, HIPAA, and GDPR: where Prime Detect fits
MSSPs carry their own obligations and inherit their clients’. NIS2 defines managed security service providers in Article 6(40) and lists them in Annex I, so many MSSPs are covered entities in their own right. Prime Detect supports the detection side of each rule below. It does not discharge any of them alone.
| Rule | What it requires | Where Prime Detect fits |
|---|---|---|
| NIS2 Art. 23 | Early warning within 24 hours and incident notification within 72 hours of becoming aware of a significant incident | Surfaces chained activity earlier, so your team becomes aware sooner and has ATT&CK-mapped evidence for the notice |
| DORA Art. 28 | Financial entities stay fully responsible for DORA compliance when they use ICT service providers | Gives your financial clients a per-tenant record of what was detected, which they need to show oversight of you |
| HIPAA 45 CFR 164.312(b) | Mechanisms that record and examine activity in systems containing ePHI | Examines every event in the stream and records matches with severity and technique. Logging and retention stay in the SIEM |
| HIPAA 45 CFR 164.308(b), 164.314(a) | Business associates report security incidents they become aware of to the covered entity | Tagged matches and attack chains give you the detail to report quickly and specifically |
| GDPR Ch. V (Arts. 44–49) | Transfers of personal data outside the EU/EEA only under Chapter V conditions, including onward transfers | Runs inside your or your client’s pipeline with no outbound connection, so detection itself adds no transfer |
Sell coverage, not ingest
Most MSSPs price and staff around SIEM volume. That ties margin to how much data clients send, and ties coverage to which platform each client happens to run.
Prime Detect separates the two. Every client gets the same detection baseline. You send the SIEM only the events that matter. Each tenant gets an ATT&CK-mapped record of what you detected, which is the evidence regulated clients need to show oversight of their provider. Your engineers spend their time on the detections that set your service apart.
See it run. Watch Prime Detect work against a live event stream before you commit to a pilot. Request a demo, explore the live demo, or download the open source version to run it yourself.
FAQ
How can an MSSP keep detection capacity in step with client growth?
Take rule capacity out of each client’s SIEM. Prime Detect runs detections on the event stream, so coverage scales with the compute you assign, not with SIEM limits. Each new client gets the same 20,000+ detections, whether they run one SIEM or another.
What is the difference between pre-SIEM detection and direct SIEM ingestion?
With direct ingestion, logs go into the SIEM and detection rules run there. Pre-SIEM detection runs the rules on events in transit, before the SIEM ingests them. Prime Detect is a pre-SIEM detection layer. It tags matches and lets you send only high-priority events to the SIEM.
Can one Prime Detect deployment serve multiple clients?
Yes. MSSPs can run a shared multi-tenant deployment with detections and routing set per tenant. They can also deploy inside a client’s own infrastructure when data residency or an air gap requires it.
How is Prime Detect licensed for MSSPs?
Prime Detect is available open source or under an Enterprise license. Enterprise licensing for MSSPs is typically based on the number of clients served. Contact SOC Prime for pricing for your architecture.
What do NIS2 and DORA require of MSSPs?
NIS2 defines MSSPs and brings many of them into scope as covered entities. Under Article 23, they must give an early warning within 24 hours of becoming aware of a significant incident and a notification within 72 hours. Under DORA Article 28, financial clients remain fully responsible for their own compliance when they use an MSSP, so they will expect evidence of what you detect.
What does HIPAA require for audit trails and incident reporting?
The HIPAA Security Rule, 45 CFR 164.312(b), requires mechanisms that record and examine activity in systems containing electronic protected health information. Under 164.308(b) and 164.314(a), a business associate must report security incidents it becomes aware of to the covered entity, including breaches of unsecured protected health information.
Does pre-SIEM detection create GDPR data transfer issues?
Not by itself. Prime Detect runs inside your or your client’s pipeline and needs no outbound connection, so detection adds no transfer of personal data. Where the rest of the data goes, and under which Chapter V mechanism, remains your firm’s decision.
Will Prime Detect commoditize our detection engineering service?
It shifts where your engineers spend their time. Baseline coverage comes from the 20,000+ rule library, which SOC Prime keeps adding to. Your team can focus on client-specific detections, threat hunting, and tuning, which is the work clients see as your differentiator.
