SIEM, antifraud and Service Desk in one solution

A comprehensive platform for threat detection and incident handling

At Cybrexon, we combine SIEM and antifraud rules, event analytics, vulnerability management and a built-in Service Desk. Use the visual rule editor, event correlation, SQL queries and shared dashboards. Your team can inspect the data behind a detection, the affected server’s status, incident assignments and action history.

Get a free trial

Feature overview

Watch the full video

Search and SQL analytics

Filter by fields and original text, group events, calculate aggregates and plot activity over time. Open matching events from a result group with the same filters and period. Save searches and analytics settings for reuse.

Visual editor and correlation

Field conditions, regular expressions, reference lists, thresholds and time windows. Link several event sets by shared fields and a defined sequence, such as failed logins followed by a successful login.

Alerts and investigation history

An alert retains rule details and the triggering events. An incident contains linked alerts and vulnerabilities, an assignee, deadlines, discussions and files. History shows status and assignment changes.

Automation and delivery

Configure external HTTP actions and notifications by email, Telegram, Slack and Microsoft Teams. Action and delivery results are available for review. Automatic alert closure requires a confirmed successful action, when this setting is enabled.

Servers and log delivery monitoring

CMDB shows each server’s purpose, owners, sources and latest event arrival. Configure notifications when collection stops or resumes; internal IPs and packages are available when inventory collection is enabled.

Runbooks selected for rules

Link a rule to a knowledge base article. Its detection result provides the selected runbook with investigation and response steps. Article permissions are defined by role and category.

DETECTION RULES

Visual editor, correlation and rule testing

Create a rule from a search or in the editor. Conditions have visual and text views; configure sources, thresholds, time windows, grouping and detection results separately. Test a rule against saved events before enabling it.

Conditions and exclusions

AND/OR groups, value comparisons, regular expressions, field existence checks and reference lists. Nested groups determine which conditions an exclusion applies to.

Thresholds and correlation

Event counts, unique counts and numeric aggregates. Separate counters by user, address or server. Link several event sets and check their order within a time window.

Testing against events

Preview shows matches, examples of accepted and excluded events, and condition evaluation results. The test does not create live alerts or perform external actions.

Results and repeated matches

Set the result type, severity, category, assignee and runbook in the rule. Merge repeated matches for a group into one record; enable linked incident creation separately.

SQL and visual event analytics

Select grouping fields, metrics and a result view in the builder. SQL lets you specify filters, grouping, aggregates and sorting in a query. For example, count errors by server, count unique client addresses or calculate average API response time for a selected period.

Count, unique values, sum, average, minimum and maximum
Tables, bar charts and time series with access to source events
Saved searches, analytics settings and result export

Service Desk: assignments and work history

An incident brings together related alerts and vulnerabilities; service requests track help and configuration work. Each record has a number, assignee, priority and deadline. Discussions retain comments and attachments; history records changes to assignee and status, with an author and timestamp.

Search by number and filter by status, assignee, category and dates
Assignments, mentions and replies in a personal inbox
Reopen records while retaining discussions and history

Vulnerabilities, repeat scans and decisions

Scanner reports provide the affected asset, severity, CVE/CVSS where available, evidence and recommendations. Repeat scans add to the finding’s history. The owner records remediation, risk acceptance or a false positive decision; absence from a single report does not close the finding automatically.

Owner, status, observation history and changes
Remediation, risk acceptance and false positive decisions
Vulnerability status stays independent when a linked incident closes

Knowledge base and runbooks

Store investigation instructions, response procedures, notes and contacts in the knowledge base. Select a specific runbook in a rule for reviewers to open when handling a detection. Materials have versions and access restrictions.

Verification, investigation and response steps
Instructions linked to rules and records
Material versions and role-based access

Indicators for threat detection

Our service provides lists of malicious addresses and indicators of compromise, including CERT data. Rules compare event fields against these lists and create detections for investigation.

Lists of addresses and other indicators
Reference lists in detection rules
Validate detections against source events

Dashboards, reports and audit log

Shared dashboards display tables, metrics, rankings and time series. Open source data from a widget with the same filters. Select periods, sections and fields for reports. The audit log records the actor, time, action type and affected object.

Event and record widgets, tabs and automatic refresh
Status changes, assignments and automation results
Data and actions controlled by roles and permissions

An example review: a dashboard shows an increase in errors, the chart opens the corresponding events, the alert shows the triggering data, and the incident shows the assignee and work history. An automated action has its own result and execution time.

INTEGRATIONS AND CONFIGURATION

Custom event formats, fields and rules

Parsers extract fields from infrastructure and custom application logs. Configure field names and types for search, SQL analytics and rules. The visual editor lets you define conditions, thresholds and event sequences using this data; access, notifications and external actions are configured separately.

Event parsing and normalisation

Configure format recognition, fields and transformations in the visual parser editor. Test a sample to see the parsing result before publishing. The event record provides extracted fields and the saved original.

Rules and schedules

Define field conditions and exclusions in the visual editor or a text expression. Configure thresholds, grouping, time windows, event sequences and the rule’s active schedule with a time zone.

Permissions for data and actions

Roles restrict access to event streams, categories and individual operations. Viewing, editing and export can be permitted separately. The audit log records the actor, time, action and affected object.

RULE CONFIGURATION EXAMPLE

High request volumes to sensitive paths

To detect web application reconnaissance, select characteristic paths, group requests by source address and server, and set a threshold over five minutes. Exclude trusted scanners using a reference list. Testing shows which events satisfy the conditions.

Fields from application logs

The parser extracts the client address, server, path and request result. Testing shows the field values alongside the original event.

Conditions in the editor

Combine paths in an OR group. Use AND to add other conditions and exclude trusted scanner addresses.

Grouping and threshold

Count events or unique paths within the window for each address–server pair. Set the threshold and the period for merging repeated detections.

Test and enable

Preview shows matches, excluded examples and condition evaluation results. After review, enable the rule and its selected actions.

Notifications and external HTTP actions

Select delivery channels and a configured HTTP request to an external system for a rule. The alert shows success, failure or a skipped action; delivery history shows the message result. When automatic closure is configured, the alert closes after the external action has confirmed success.

CYBREXON ENGINEERING TEAM

Integration, rules and engineering support

We connect sources and configure parsers, SIEM and antifraud rules, dashboards and notifications. We help review detections and scan results; Enterprise includes monitoring and response. We report identified critical issues and vulnerabilities as part of the service.

Discuss your needs

ANTIFRAUD

Antifraud for applications and digital services

Rules use authentication, operation and API events: account, address, amount, result and operation ID. Count repeats and unique actions, compare sums against thresholds and correlate event sequences. Detections retain data for review and can automatically create linked incidents.

Account abuse

A sequence of failed logins and a subsequent successful login are linked by user and server. Set the threshold, time window and event order in the rule; source events remain available for review.

Operations and transactions

Rules count events and unique operations, check sums and action sequences. With a stable operation ID, repeated messages about the same operation can count once in a unique-value calculation.

Bots and API abuse

Group requests by address, account or service. Conditions use the path, method, result and request frequency; reference lists define exclusions for trusted sources.

RULE CREATION AND TESTING

Operation fields, thresholds and historical testing

Use the visual editor to define conditions, grouping and event sequences. Testing against saved history shows matches and explains which conditions excluded sample events. SQL queries and access to original records support further analysis.

01Select streams and fields: user, operation, amount, result
02Conditions, threshold, grouping, time window and exclusions
03Check matches and exclusions against saved events
04Configure the result, assignee, runbook and notifications

REVIEW OPERATIONS AND TEAM ACTIVITY

Operation events and investigation participants’ actions

Use SQL and visual analytics to count operations by user, address and period, then open the events in a selected group. Add related alerts to an incident. History shows assignee and status changes, the discussion holds comments and attachments, and the alert shows automated action results.

The rule set depends on the fields supplied by the application. Integrations and actions in transaction systems are defined separately for each implementation.

Discuss antifraud

PLANS

Monitoring and support plans

From help with the first sources to monitoring and response by our team. Each plan defines the available capabilities and specialist involvement; your IT team retains the tools for independent analysis and incident handling.

Trial (1 month)

Test threat detection with your own data.

Two servers · 5 hours of support from our engineers included for the trial.

Threat detection: 30+ ready-to-use rules for detecting malicious activity, MITRE ATT&CK.
Alert investigation: Access to raw logs, alerts and notifications.
Custom detection scenarios: Rule creation, parser development, reference lists, blocklists and allowlists, templates and regular expressions.
Incident management: Built-in Service Desk and response automation.
Infrastructure inventory: CMDB and installed software inventory.
Reporting and transparency: Customizable PDF reports and activity auditing.

Get a free trial

Quick Start

Start detecting threats and managing incidents with ready-to-use rules and support from our engineers.

One user account · Includes 5 hours of support per month

Threat detection: 30+ ready-to-use rules for detecting malicious activity, MITRE ATT&CK.
Alert investigation: Access to raw logs, alerts and notifications.
Custom detection scenarios: Rule creation, parser development, reference lists, blocklists and allowlists, templates and regular expressions.
Incident management: Built-in Service Desk for incident management and tracking SLA deadlines.
Response automation: Configuration of automated actions.
Infrastructure inventory: CMDB and installed software inventory.
Investigation guidance: A knowledge base with ready-to-use runbooks and instructions.
Reporting and transparency: Customizable PDF reports and activity auditing.

Request Quick Start

Recommended

Pro

Detect threats and fraud, find connections between events and track vulnerability remediation.

Includes 10 hours of support per month

Threat and fraud detection: 30+ rules for detecting malicious activity, 10+ antifraud rules, MITRE ATT&CK.
Tailored rules: Development and maintenance of detection scenarios for your systems and requirements.
Event analysis: Access to raw logs, grouping, statistical metrics and time-series charts.
Related event detection: Event correlation, including cross-stream correlation.
Data visualization: Customizable dashboards and widgets.
Configure your own detections: Rule creation, parser development, reference lists, blocklists and allowlists, templates and regular expressions.
Incident management: Service Desk, alerts and notifications, automatic assignee allocation, SLA tracking and response automation.
Vulnerability management: Scan imports and history, prioritization, remediation tracking and tracking of recurring findings.
Infrastructure inventory: CMDB and installed software inventory.
Investigation guidance: A knowledge base with ready-to-use runbooks and instructions.
Access control: Roles and granular permissions for data and actions.
Reporting and transparency: Customizable PDF reports and activity auditing.

Request Pro

Enterprise

Entrust monitoring, threat detection and response to the team that develops the solution.

Monitoring and response by our team

Expert support: Monitoring alerts and carrying out agreed response actions.
Threat and fraud detection: 30+ rules for detecting malicious activity, 10+ antifraud rules, MITRE ATT&CK.
Tailored rules: Development and maintenance of detection scenarios for your systems and requirements.
Event analysis: Access to raw logs, grouping, statistical metrics and time-series charts.
Related event detection: Event correlation, including cross-stream correlation.
Data visualization: Customizable dashboards and widgets.
Configure your own detections: Rule creation, parser development, reference lists, blocklists and allowlists, templates and regular expressions.
Incident management: Service Desk, alerts, informational events and notifications, automatic assignee allocation, SLA tracking and response automation.
Vulnerability management: Scan imports and history, prioritization, remediation tracking and tracking of recurring findings.
Infrastructure inventory: CMDB and installed software inventory.
Investigation guidance: A knowledge base with ready-to-use runbooks and instructions.
Access control: Roles and granular permissions for data and actions.
Reporting and transparency: Customizable PDF reports and activity auditing.

Request Enterprise

eLearning

eLearning — a corporate learning management system

Our own learning management system, ready-made courses and programmes tailored to your company’s needs. We help make employee training an ongoing process: from onboarding new hires to regularly refreshing their knowledge.

Make training part of employee onboarding, preparation for new tasks and updates to internal rules. Ready-made and custom courses — in one system.

Find a training programme

Foundational information security courses
Help employees recognise common threats and handle corporate information safely. Foundational training for the entire team, focused on situations people encounter every day.
Specialised information security courses
Give employees the knowledge they need in their work. Courses in specific areas of information security for different roles, tasks and levels of experience. Including secure development using established industry practices.
Courses addressing regulatory requirements
Prepare employees to work with information security and personal data protection requirements. Training helps them apply the necessary rules in their daily work, taking your industry and company’s activities into account.
Custom course development
Train employees using your company’s rules and workplace situations. We develop courses based on internal policies, processes and materials.

Contact us

Discuss specific sources, event formats, detection rules, analytics queries and incident handling. These requirements define the configuration, integrations and specialist involvement needed.

Infrastructure, applications and available events

Visual rule editor, correlation and SQL analytics

Vulnerabilities, investigations, automation and monitoring

Our own product

We develop the detection engine, visual rule and parser editors, analytics, CMDB and Service Desk. Discuss event formats, detection conditions and integrations directly with our engineering team.

Engineering support

Our specialists help connect systems, configure SIEM and antifraud, investigate incidents and work with scan results. Enterprise includes monitoring and response by our team; the plan defines the extent of our involvement.

Audits and consulting

We review monitoring arrangements, configurations and security practices. The result is a set of identified issues, recommendations and materials for planning remediation.