Mars Security brings threat intelligence to detection in real time
Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.
Mars Security announced a capability that automatically turns newly published threat intelligence from sources like CISA, Mandiant, Unit 42, and Microsoft into MITRE ATT&CK-mapped detection rules. Each rule is written in the native query language of the customer's telemetry (CrowdStrike Falcon, Wiz, Splunk, firewalls, identity providers, AWS, Snowflake, Databricks) and backtested against 30 days of the customer's data before deployment, with indicator scoring to drop noisy or stale indicators. The platform also maps existing detection coverage, flags gaps such as AWS CloudTrail tampering and pass-the-hash movement, and delivers some recommendations as open pull requests for detection-as-code workflows.
- Automates advisory-to-detection pipeline, claiming minutes instead of the typical days-to-weeks SOC cycle.
- Rules backtested against 30 days of customer data with false-positive counts shown before activation.
- Coverage gap analysis flags issues like CloudTrail tampering, Route 53 abuse, and Microsoft Graph API anomalies.
- Extends to monitoring AI coding agents and credentials leaked into logs without new tooling.
From the original article
3 min read at helpnetsecurity.comMars Security has announced Real-Time Intel-Based Detection, a capability that turns newly published threat intelligence into validated, ready-to-deploy detection rules within minutes of release.
By Industry News · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.