Understand the data
Check log sources, field quality and the limits of visibility.
CYBERSECURITY RESEARCH & TOOLS
Turn security data
into meaningful
detections.
A focused workspace for research, Windows telemetry and detection engineering. Clearer evidence. Better analyst decisions.
Early stage • Product development
DETECTONIC / 01WINDOWS × SPLUNK
LOCAL PROTOTYPE
01
SignalWindows Event
469802
Contexthost · user · task
03
DraftSplunk SPL
index=windows EventCode=4698
| stats count by host, TaskName
| stats count by host, TaskName
RESEARCHTELEMETRYDETECTIONHUMAN REVIEW
EVIDENCE SHAPES THE DECISION.
From research to
everyday analyst work.
Detectonic brings security data analysis and detection design together. Windows and Splunk are our first focus. SOC and DFIR are the next steps in the same approach.
Build the logic
Turn observations into an SPL draft and state the assumptions.
Follow the evidence
Test in your environment. Keep the final decision with the analyst.
FIRST PRODUCT / WINDOWS + SPLUNK
Detection Workspace
Review Windows events. Find missing fields. Build a first query draft for Splunk.
Available today
In-browser JSON log review, field checks and template-based SPL drafting.
Development direction
Claude assistance, evaluation with test data, then SOC / DFIR workflows.
DETECTONIC JOURNAL
Start with curiosity.
Continue with evidence.
Open research notes on Detection Engineering, DFIR, SOC and Threat Hunting. A separate space designed for reading.
Visit Detectonic JournalJOURNAL / RECENT NOTESAll notes ↗
Detection Engineering: from behavior to a testable rule
A detection design approach that considers the data source, normal behavior and validation conditions together.
Windows Scheduled Tasks: an evidence and correlation map
Read task definitions, file and registry artifacts, event records and execution evidence together.
SOC alert triage: from a signal to a reasoned decision
A systematic investigation from the alert title to source evidence, asset context and a documented decision.