Follow tl;dr
Prime Detect runs detection rules on your event stream before data reaches the SIEM. It applies Sigma rules to events in transit, tags each match with a severity and a MITRE ATT&CK technique, and links related matches into attack chains. In client testing, about 7% of telemetry was tagged. That is the slice worth sending to your SIEM.
Large organizations use Prime Detect to run 20,000+ detections without SIEM rule limits, cut what they pay to ingest, and keep a mapped record of what they detect for regulations such as DORA and NYDFS. It works alongside your existing SIEM. It does not replace it.
Why banks are moving detection ahead of the SIEM
A SIEM runs detection rules against data it has already ingested and indexed. For a large bank, that model hits two limits.
Rule capacity. Most SIEM deployments run a few hundred active rules before search performance and cost become a problem. A team running 500 of them is choosing what not to see.
Ingest cost. Every event the SIEM ingests is an event you pay to store and search, whether or not it carries a threat signal.
Prime Detect moves detection upstream. Rules run against events as they stream through your Kafka pipeline, before ingest. Rule count is tied to the compute you give it, not to SIEM capacity. You then decide what reaches the SIEM based on what the rules found.
Regulators set the floor. DORA Article 10 requires mechanisms to promptly detect anomalous activity. NYDFS Part 500 requires larger covered entities to centralize logging and security alerting. Neither sets a rule count, but both expect you to show that your detection program works. More detections, each mapped to ATT&CK, give you broader coverage and a clearer record of it.
What Prime Detect does
Detection in the stream
- Applies Sigma rules to events in transit, before SIEM ingest
- Runs 20,000+ detection rules plus your own custom detections, with no fixed rule ceiling
- Tags every match with a severity and a MITRE ATT&CK technique
- Links related matches into attack chains, so analysts see a sequence of activity instead of isolated alerts
Tagged telemetry you can route
- Tags about 7% of telemetry, based on client testing
- Sends tagged events to the SIEM and the rest to warm or cold storage, by your rules
- Produces structured, ATT&CK-labeled events that AI triage and SOAR tools can use directly
Deployment and control
- Runs on the Kafka and Kubernetes your team already operates
- Keeps data inside your pipeline, with no outbound connection required
- Deploys air-gapped or in the cloud
- Available open source as DetectFlow, or under an Enterprise license
How it fits with your existing SIEM
Prime Detect sits between your event pipeline and your SIEM. Nothing in the SIEM has to change. Most teams roll it out in three steps:
- Forward everything to the SIEM as today, with Detect tags added to matched events.
- Add a SIEM index or dashboard that raises Detect-tagged events as high-priority alerts.
- Once tuned, route untagged events to warm or cold storage to cut ingest.
You can change the routing at any point as you learn what works in your environment.
What Prime Detect does not do
- It does not replace your SIEM for centralized logging, search, investigation, or retention.
- It does not satisfy the NYDFS centralized logging requirement on its own.
- It does not decide whether an incident is material or reportable. Your team makes that call.
DORA, NYDFS, and SEC: where Prime Detect fits
These rules set detection, incident, testing, and disclosure duties for the banks they cover. Prime Detect supports the detection side of each. It does not discharge any of them alone.
| Rule | What it requires | Where Prime Detect fits |
|---|---|---|
| DORA Art. 9 | Continuously monitor the security and functioning of ICT systems | Runs detections on every event in the stream, not a sampled subset |
| DORA Art. 10 | Mechanisms to promptly detect anomalous activity | Detects in transit, ahead of SIEM ingest and indexing |
| DORA Art. 17 | An incident process to detect, manage, classify, and notify | Each match carries severity and ATT&CK technique, giving a structured basis for classification |
| DORA Art. 26 | Threat-led penetration testing (TLPT) at least every 3 years, if designated | ATT&CK mapping shows which tested techniques you had detections for |
| NYDFS 500.14(b) | Class A companies: EDR plus centralized logging and security alerting | Adds detection coverage in front of your centralized logging. Does not replace it |
| NYDFS 500.17(a) | Notify the superintendent within 72 hours of determining an incident occurred | Surfaces chained activity earlier, so investigation can start sooner |
| SEC Form 8-K Item 1.05 | Registrants: determine materiality without unreasonable delay, file within 4 business days of that determination | Attack chains give the team scoping evidence faster. The materiality call stays with you |
The detection record examiners ask about
When an examiner asks how a bank detects threats, the answer is usually a list of SIEM rules. With Prime Detect, every detection is mapped to ATT&CK and tagged at the event level. You can show what you were watching for, what fired, and how related activity chained together.
That is the record DORA’s incident process and NYDFS’s 72-hour notice depend on. When an incident happens, the work of building it should already be done.
See it run. Watch Prime Detect work against a live event stream before you commit to a pilot. Use the default user name and passwords listed. Request a demo, explore the live demo, or download DetectFlow to run it yourself.
FAQ
What is pre-SIEM detection?
Pre-SIEM detection runs detection rules on events while they move through the data pipeline, before the SIEM ingests them. A SIEM-based model runs rules only on data the SIEM has already ingested. The difference is where the detection logic executes. Prime Detect is SOC Prime’s pre-SIEM detection layer
How can a bank run more detection rules without adding SIEM capacity?
Run the rules outside the SIEM. Prime Detect executes rules on the bank’s own Kafka and Kubernetes infrastructure, so rule count depends on that compute rather than SIEM limits. Banks can run 20,000+ rules instead of the few hundred a typical SIEM holds.
How much data does Prime Detect send to the SIEM?
That is your choice. In client testing, Prime Detect tagged about 7% of telemetry. Teams can send only tagged events to the SIEM and route the rest to lower-cost storage.
Does pre-SIEM detection satisfy NYDFS 500.14(b)?
No, not on its own. Section 500.14(b) requires Class A companies to centralize logging and security event alerting. Prime Detect adds detection in front of that system. It does not replace it.
How is Prime Detect different from a pipeline tool like Cribl?
Pipeline tools route, reduce, and transform data. Prime Detect runs detection logic on the data and tags what it finds. The two can run together: the pipeline shapes the stream, and Prime Detect identifies the threats in it.
Can Prime Detect run in an air-gapped environment?
Yes. Prime Detect runs inside your own pipeline and needs no outbound connection. It also supports cloud deployment.
Is Prime Detect open source?
Yes. The open source version is DetectFlow. SOC Prime also offers an Enterprise license.
