SinonAlert ingests from 55 connector types, evaluates 24 rule types, and drives alerts through triage, cases and SOAR playbooks, entirely on your infrastructure. It imports your existing ElastAlert2 and Sigma rules and tells you exactly what did not translate, rather than dropping it silently.
Self-host or SinonTech-hosted. 468 starter rules. Air-gap capable.
Native SinonAlert clients. The macOS and Linux desktop apps are available now in alpha; Windows, iOS and Android are on the way. Contact us to join the alpha.
Connector Types
Splunk, Elastic, Microsoft Defender, CloudTrail, syslog, webhooks and more: each a real implementation, not a roadmap entry.
Rule Types
Beaconing, impossible travel, DGA detection, honeypot access, behavioural baselines, and multi-source correlation among them.
Starter Rules
Shipped as YAML in the catalogue. The platform detects on day one rather than after a quarter of rule writing.
Pre-Built Actions
15 SOAR containment actions (isolate, block, disable, quarantine) plus 20 notification actions.
Deployment Modes
Bare metal, Docker, Kubernetes, cloud VMs, virtual environments, and fully air-gapped.
Detection logic is the most expensive thing a SOC owns and the hardest thing to move. Most platforms will happily import your rules and quietly discard whatever they cannot represent. You discover the gap during an incident. SinonAlert does the opposite: it reports translation fidelity explicitly, and tells you which rules did not convert and why.
Native importers with format auto-detection and bulk import. Point it at your rule directory; it works out what each file is. SinonAlert is designed as a direct ElastAlert2 replacement rather than a loose equivalent.
One-way translators pull detection content out of the incumbent platforms, so a migration is an import job rather than a rewrite project.
Every import produces a fidelity report flagging what could not be converted. Elastic EQL queries, for instance, are explicitly reported as untranslatable and preserved as raw DSL rather than silently mangled.
Twenty-four rule types, each with a real evaluator behind it. The breadth goes well past threshold-and-frequency matching into the behavioural detections that ordinarily require a separate product.
Beaconing, impossible travel, domain generation algorithms, honeypot access, behavioural baselining, and multi-source correlation: implemented evaluators, not category names.
Rules map to ATT&CK techniques with a coverage heatmap showing where you are blind. Loads the full ATT&CK STIX bundle, with a curated offline subset as fallback for air-gapped networks.
A filter-tree editor with an ATT&CK technique picker for analysts who do not write YAML, backed by the same rule AST as everything else. No second, weaker rule engine.
Replay historical events against a rule before it goes live. Time-travel testing and false-positive analysis let you tune a detection against real data instead of guessing thresholds in production.
GitOps workflow with webhook handling, automated pull-request creation, conflict detection, and dual-write orchestration. Rules live in Git and are reviewed like code.
Scheduled and ad-hoc notebooks with a cell runner for threat hunting, so investigation work is repeatable and reviewable rather than living in someone's shell history.
Alerts land in a triage inbox, become cases, and drive playbooks. Thirty-five pre-built actions ship with the platform — fifteen that actually contain something, and twenty that tell someone about it.
Isolate a host, block an indicator, disable an account, quarantine a file. The actions that change the state of your estate, ready to wire into a playbook.
Route to the places your team already lives (chat, ticketing, email, webhooks) without writing an integration for each one.
SOC 2, ISO 27001, HIPAA and PCI reporting with controls held as data rather than hardcoded, so frameworks can be extended without a release.
When an incident goes to a regulator or a court, the question is not what your SIEM showed. It is whether the record can be trusted. SinonAlert answers that in the schema rather than in a policy document.
Every entry carries the hash of the entry before it. Editing or deleting a record after the fact breaks the chain, and an independent verifier will find the break.
The verifier is a separate component from the writer, so proving integrity does not mean asking the thing that wrote the log whether it lied. Chains can be replayed across regions.
Organisation, tenant and sub-tenant, with a scope cascade for MSSPs running detection for many clients. Every row is tenant-scoped and each tenant keeps its own audit chain.
SinonAlert ships an AI Copilot for rule generation, triage assistance and rule repair — and it is honest about where the intelligence comes from. Point it at Anthropic, OpenAI, Ollama or your own vLLM endpoint and it uses that. Give it nothing and it falls back to deterministic local paths that produce schema-conforming output with no network call at all.
That fallback is what makes the platform deployable in an air-gapped SOC without a quiet dependency on someone else's API. It is a fallback, not a substitute: AI quality is a function of the model you configure. We would rather tell you that here than have you discover it after deployment.
A stateless API that scales horizontally, plus four singleton background loops (scheduler, probe, outbox and heartbeat) coordinated by PostgreSQL-based leader election. No external coordination service to run.
An installer with systemd units and an operations control script for day-two work.
Compose files for development, production and air-gap, with PostgreSQL 16 and Redis.
A Helm chart with horizontal pod autoscaling, pod disruption budgets, ServiceMonitor and PrometheusRule.
AWS, Azure, GCP, or anywhere else you can get a Linux box.
VMware, Hyper-V, Proxmox — standard virtualisation, no special casing.
A bundle packager and offline installer, offline ATT&CK loading, and an AI stack that degrades to local paths. No data leaves your network.
| Connectors | 55 built-in types — Splunk, Elastic, Microsoft Defender, AWS CloudTrail, syslog, webhook, and SaaS APIs |
|---|---|
| Rule types | 24 evaluators, including beaconing, impossible travel, DGA, honeypot access, behavioural baseline and multi-source correlation |
| Rule catalogue | 468 starter rules shipped as YAML |
| Rule import | ElastAlert2 and Sigma importers with format auto-detection, bulk import and translation-fidelity reporting |
| Rule translation in | Elastic SIEM, Splunk ES, Microsoft Sentinel (one-way) |
| Actions | 35 pre-built: 15 SOAR containment, 20 notification |
| Threat mapping | MITRE ATT&CK with coverage heatmap; full STIX bundle load with curated offline subset fallback |
| Detection as code | GitOps with webhook handling, PR creation, conflict detection, dual-write orchestration |
| Compliance | SOC 2, ISO 27001, HIPAA, PCI — controls stored as data, not hardcoded |
| Audit | SHA-256 hash-chained log with an independent verifier and cross-region chain replay |
| Identity | 5 SSO providers: SinonAuth, Google, Microsoft, generic OIDC, SAML. Local login always available. |
| Multi-tenancy | Organisation → tenant → sub-tenant with scope cascade; application-enforced isolation with per-tenant audit chains |
| Databases | PostgreSQL 16 (33 migrations), Redis |
| API | 72 routers, 384 route operations, OpenAPI documented |
| Architecture | Stateless API scaling to N replicas, plus scheduler, probe, outbox and heartbeat loops with PostgreSQL leader election |
| AI | Bring-your-own-LLM — Anthropic, OpenAI, Ollama or vLLM — with a deterministic offline fallback for air-gapped deployment |
| Backend stack | Python 3.11+ (ships on 3.13), FastAPI, SQLAlchemy 2 async, Pydantic v2, Alembic, OpenTelemetry |
| Frontend stack | React 18 with TypeScript, Vite, Redux Toolkit, Tailwind CSS, Monaco editor |
| Disaster recovery | Operator-driven multi-region failover with audit-chain pinning and failover tracking |
| Deployment | Bare metal (systemd), Docker Compose, Kubernetes (Helm, HPA, PDB), cloud VMs, virtual environments, air-gapped |
A self-hosted, multi-tenant detection and response platform. It ingests events from 55 connector types, evaluates them against 24 rule types, and drives the resulting alerts through a triage inbox, cases and SOAR playbooks. It ships 468 starter rules, maps detections to MITRE ATT&CK, and records every action into a hash-chained audit log. It runs on PostgreSQL and Redis on your own infrastructure.
Umbra is a full security operations platform: log storage, search, and twelve enterprise modules across the whole SOC. SinonAlert is focused on detection and response specifically: rules, alerts, triage, cases and playbooks, sitting on top of the data sources you already have. If you already run Splunk, Elastic or Defender and want to replace your detection layer without replacing your log platform, SinonAlert is the narrower fit. They deploy independently.
Yes — this is what SinonAlert is built for. It ships ElastAlert2 and Sigma importers with format auto-detection and bulk import, so you point it at a rule directory and it works out what each file is. Every import produces a translation-fidelity report naming what could not be converted and why. Rules that cannot be represented are flagged and preserved rather than silently dropped, which means you find the gaps during migration instead of during an incident.
No. SinonAlert runs on PostgreSQL and Redis. Elastic is supported as a connector (a place to read events from), not as a dependency you must operate. The same applies to Splunk, Defender and CloudTrail: they are sources, not requirements.
You bring the model. The AI Copilot supports Anthropic, OpenAI, Ollama and vLLM endpoints, and it uses whichever you configure, so if you point it at a local Ollama or vLLM instance, nothing leaves your network. With no model configured it falls back to deterministic local paths that produce schema-conforming output without any network call. That fallback is what makes air-gapped deployment work, but it is a fallback: the quality of AI assistance depends on the model you connect.
Yes, end to end. There is a bundle packager and an offline installer, air-gapped Docker Compose and Helm values, offline MITRE ATT&CK loading from a local bundle path, and an AI stack that degrades to zero-dependency local paths. Detection, triage, cases, playbooks, compliance reporting and the audit chain all function with no route to the internet.
Three levels (organisation, tenant and sub-tenant) with a scope cascade, which suits an MSSP running detection for many clients. Every row is tenant-scoped and each tenant maintains its own audit chain. To be precise about the mechanism: isolation is enforced in the application layer through tenant filters on every query, not through PostgreSQL row-level security.
Closed beta. It is the most substantial platform we build: 55 connectors, 24 rule evaluators, 468 starter rules and 33 database migrations, covered by 836 tests. Request access and we will walk you through the architecture, the migration path from your current tooling, and deployment before you commit anything.
SinonAlert is in closed beta. Request access for a migration assessment against your current rules, deployment documentation, and an architecture walkthrough.
Talk to an engineer about migrating your detections onto infrastructure you own — or let us host it for you and still own every byte.