Skip to main content

Introduction

What AlphaSOC is, how it works, and where to start.

AlphaSOC is a security data platform built for agentic threat hunting and investigations. It collects telemetry from your cloud, application, network, and endpoint sources, normalizes every event to the Open Cybersecurity Schema Framework (OCSF), enriches it with threat intelligence, and detects threats as the data arrives. Everything is stored in a security data lake, where your analysts and AI agents query the same data.

Common Challenges​

Security teams that rely on a SIEM for detection and investigation face three common challenges:

  • Blind spots from ingestion costs: SIEM licensing grows with data volume, so teams leave sources out or sample them, and attacks in that data go unseen.
  • Detection waits on indexing: Most SIEMs detect threats only after events are ingested, indexed, and stored, so findings lag the activity behind them.
  • Short retention: A typical SIEM keeps 7 to 30 days of data hot. Older events are archived, slow to search, or gone by the time an investigation needs them.

How It Works​

AlphaSOC uncovers threats hidden within your logs in three stages:

  1. Collect & Normalize: your sources send telemetry, and AlphaSOC maps every event to OCSF on arrival.
  2. Enrich & Detect: AlphaSOC enriches each event with threat intelligence, then runs managed detections and your Sigma rules.
  3. Index & Store: everything the Analytics Engine produces is stored in the Security Data Lake.

Your analysts and AI agents then query the lake directly.

Collect & Normalize

Load raw telemetry from any source

Automatically map events to OCSF

Enrich & Detect

In-built threat intelligence and analysis

Bring your own Sigma detection rules

Index & Store

Run fast, optimized searches

Long-term retention for threat hunting

The Architecture page explains the two parts, how data moves through the pipeline, and how your tools and AI agents work with it.

What You Get​

  • Investigate Anything™ with AI. Ask your agent, not your SIEM. Connect Claude or another MCP client to the AlphaSOC MCP server and ask, for example, "what fired last night?". The answer comes from your own telemetry.
  • 18 months of hot retention. Findings, evidence, and activity stay searchable in the Security Data Lake for 18 months by default, with nothing archived to restore before you can search it. Retention is configurable.
  • Patient zero coverage. Cross-tenant prevalence analysis and active scanning reveal threats that don't yet have known indicators, for example a destination no other AlphaSOC customer has contacted.
  • Managed threat intelligence. 1M+ live, curated indicators from 70+ sources enrich every event, with no feeds or lookups to license.
  • Detect Anything™ with Sigma. Manage your rules as Detection as Code (DaC). Existing Sigma rules run as they are, with no translation into a vendor query language, alongside hundreds of managed detections aligned to MITRE ATT&CK.
  • Detection that runs ahead of your SIEM. If you keep your SIEM, findings reach it as events arrive, without waiting on indexing, and running detection upstream can reduce SIEM costs by up to 80%.

Get Started​

To go deeper, read Architecture and Capabilities.

Need help? support@alphasoc.com