One event, one rule
Typical toolMatches a single event against a rule. An attack spread over many events slips between the rules.
GarudaKavachCorrelates events across devices and time into one chain, then judges the chain.
On-prem security operations · self-healing
Every log. One verdict.
GarudaKavach runs inside your network. It gathers logs from every device, decides what is a real threat, and shows its reasons, so nobody has to trust a black box.
- place for every log
- 1
- standards reported
- 2
- logs leave your network
- 0
How it flows · live
From log to verdict,
live.
- 01
Collects the data
Logs from every firewall, server and application, in one stream.
- 02
Scans across all threats
Every event is checked against known threats: the IOCs, and the TTPs attackers reuse.
- 03
Behaviour-based detection
Events are joined into chains and judged by what they do, mapped to MITRE ATT&CK.
- 04
Verdict, report and alert
One verdict with reasons and how it could be wrong, a report for the audit, and an alert for the people who must know.
receiving logs from firewalls, servers and appsillustration
Attacks don't stay on one device.
Your logs do.
- 01
Scattered
Firewall here, server there, application somewhere else. An attack that touches three of them looks like three small events.
- 02
Unjudged
Alerts pile up faster than people can read them, and each one still needs someone to decide if it matters.
- 03
Unprovable
When an auditor or a regulator asks what happened, a search through old files is not an answer.
The fear every SOC lives with
The alert you never saw
is the one that hurts.
Every analyst knows the feeling. The queue never empties, and somewhere in it is the one that mattered.
One of these mattered. Which one?
- 01
Closed as noise
Last month the same alert was a false alarm. Today it is not. Tired eyes close it in two seconds.
- 02
Nobody awake at 3 a.m.
Attackers choose the hour when the fewest people are watching. Nights and weekends are when queues grow unseen.
- 03
Small alone, serious together
One failed login means nothing. One failed login, then a new admin, then a cleared log means everything. No single alert shows it.
- 04
Found too late
Hearing about a breach from a customer, a regulator or the press, instead of from your own tools.
Why SOCs fail
Where SOC tools
fall short.
Most breaches are not missed because people did not care. They are missed because the tools were built to match, not to understand.
Stuck at the bottom of the pyramid
Typical toolLeans on hashes, IP addresses and domains. Attackers change those in minutes.
GarudaKavachDetects the tools and techniques attackers cannot change cheaply, and still matches the known bad.
The alert flood
Typical toolMore rules, more alerts, more fatigue. The people who triage them burn out.
GarudaKavachOne verdict per chain, with reasons, so the queue shrinks to what matters.
Lateral movement is invisible
Typical toolEach device is logged on its own, so a hop from one machine to the next is never joined up.
GarudaKavachFollows an attacker from machine to machine as one story.
Quiet means safe
Typical toolSlow beacons and gentle scans stay under every threshold, so nothing fires.
GarudaKavachCorrelates timing and patterns, and looks again at the whole day's data every night.
A score with no reason
Typical toolA risk number nobody can explain, so the analyst redoes the work from scratch.
GarudaKavachEvidence for every finding, and how it could be wrong.
Nobody knows what is covered
Typical toolHundreds of rules and no map of what they actually cover.
GarudaKavachDetections mapped to MITRE ATT&CK, so the gaps are visible, not guessed.
Pyramid of Pain
Hit attackers where
it hurts.
The Pyramid of Pain ranks what you can detect by how much it costs the attacker to change it. Most tools sit at the bottom, where the attacker changes things in minutes. GarudaKavach works the top, and still catches the bottom. Every night it sweeps your own infrastructure logs for TTPs and for IOCs, on its own.
Tough
TTPs
How the attacker works, step by step. Changing it means retraining the whole operation.
Detected by behaviour
TTPs: detected by behaviour IOCs: matched against intel nightly sweep
MITRE ATT&CK
Built on ATT&CK.
Deepest where attacks spread.
Every detection is mapped to ATT&CK techniques and other industry frameworks, so you can see what is covered and what is not. The highlighted tactics are where the engine goes deepest.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Defense Evasion
- Credential Access
- Discoveryfootprint
- Lateral Movementdeep
- Collection
- Command and Controlbeaconing
- Exfiltration
- Impact
Lateral movement
Four devices, four separate logs. GarudaKavach joins them into one chain: who moved, from where, to where, and what they touched.
Footprint
Scans, account listings and quiet reconnaissance leave small traces on many devices. Together they show an attacker mapping your network.
Beaconing
Malware phones home on a schedule. GarudaKavach correlates timing, destinations and volume, so a quiet, regular signal stands out from normal traffic.
Correlates everything
- Logins
- Network flows
- Processes
- DNS
- Config changes
- Threat intel
becomes one chain.
Every night
A sweep of your logs, every night.
On its own, GarudaKavach sweeps your infrastructure's logs for TTPs and IOCs. It correlates what no single alert showed: slow beacons, quiet footprints, small steps that only add up in hindsight.
What you get
Built to decide,
not just collect.
One place for every log
Firewalls, servers and applications feed a single stream, so an attack across two devices is seen as one story.
A verdict with reasons
Each finding shows its evidence and how it could be wrong. No black box, nothing to take on trust.
Known threats matched
Events are checked against known bad addresses and indicators as they arrive.
Read-only by design
It gives a verdict. It never changes anything on your devices.
Keeps collecting
If one machine fails, log collection carries on.
Audit-ready reports
ISO 27001 and CERT-In reports come from the same data, not from a spreadsheet built the week before the audit.
Simulated example
Watch a verdict form.
Ordinary traffic scrolls past. Then a pattern builds across devices. GarudaKavach joins the dots, gives a verdict, lists its reasons, and tells you how it could be wrong.
- normal
- unusual
- serious
Verdict
Likely stolen credentials
- Five failed logins on one account, then a success.
- The success came from a country this account has not used.
- A new admin role and a cleared audit log followed.
How this could be wrong: the owner may be travelling or on a new VPN. Check with them before acting.
No action was taken on any device.
SOC L1 · L2 · L3 · coming soon
L1, L2 and L3.
Replaced, soon.
A SOC is built in levels because the work comes in levels. GarudaKavach is built to replace all three, soon, and to show its reasoning at every step.
Triage
replaced soonSorts the flood.
- Reads every alert, day and night
- Dismisses noise, with the reason
- Groups related events together
- Hands up only what matters
Investigation
replaced soonBuilds the story.
- Correlates across devices and time
- Builds the chain: who, from where, to where
- Scopes what was touched
- Writes the evidence and how it could be wrong
Hunting
replaced soonFinds what no rule was written for.
- Detects attacker techniques mapped to MITRE ATT&CK
- Sweeps TTPs and IOCs every night
- Follows lateral movement and beaconing
- Finds quiet chains no single alert showed
Dashboards
A view for
every role.
Managers, CISOs and clients each get their own dashboards, built for the question each of them asks. Pick a role to look.
What needs my team today?
Open chains7
Waiting for review3
Sources reporting24 of 24
Reports due1
| Chain | Severity | Age | Status |
|---|---|---|---|
| Credential misuse · finance servers | High | 2 h | Review |
| Beaconing · build server | High | 5 h | Review |
| Port scan · guest network | Medium | 1 d | Watching |
| Config change · edge firewall | Medium | 1 d | Watching |
How exposed are we, and can we prove it?
ATT&CK: where detection is deepest
highlighted: discovery, lateral movement, command and control
Chains per week
Compliance
- ISO 27001report ready
- CERT-Inreport ready
Top risks this week
- Lateral movement from a laptop toward the file server
- Regular outbound signal from a build server
- Admin role granted outside the change window
Is my business safe, in plain words?
Watched, around the clock.
2 items need your attention.
- A staff account was used from a new country. Please confirm it was them.
- One server is talking to an unusual address. We are watching it and will tell you if it grows.
Checked last nightLogs swept for TTPs and IOCs
Monthly reportReady to read
Two promises
On your premises.
Heals itself.
On-prem
GarudaKavach runs on your own machines. Logs, verdicts and reports stay inside your network. Nothing is sent to a vendor cloud.
Self-healing
Every service shows green or red from its real health. When one gets stuck, it restarts itself. If it cannot, you can restart it from the console.
Gap check
Where are
your gaps?
Seventeen questions, about two minutes. The answer is worked out in your browser. Nothing is sent anywhere unless you choose to email it.
Already have a SOC?
You still need this.
A SOC team is only as good as the data and the verdicts it works from.
| Area | SOC without it | SOC with GarudaKavach |
|---|---|---|
| Logs | Spread across devices, checked one by one | Collected in one place |
| Alerts | Raw alerts someone must judge | Verdict with evidence and how it could be wrong |
| Known threats | Looked up by hand | Matched automatically |
| Audits | Reports built by hand before each audit | ISO 27001 and CERT-In reports from the same data |
| Detection depth | Known bad IPs, domains and hashes | Attacker tools and techniques, mapped to MITRE ATT&CK |
| Lateral movement | Seen one device at a time | Followed across devices as one chain |
| After hours | Few eyes on the queue overnight | The day's data re-checked every night |
| Data location | May be sent to a vendor cloud | Stays inside your network |
Compliance
ISO 27001CERT-In
Policy packs and reports for the standards you are audited against, built from the same data your team already works with.
Questions
Do my logs leave my network?
No. GarudaKavach is self-hosted and runs on your own machines.
Will it change or block anything on my devices?
No. It gives a verdict with reasons and never acts on a device.
Which standards does it report against?
ISO 27001 and CERT-In directions.
Which framework are detections built on?
MITRE ATT&CK and other industry frameworks. Detections are mapped to techniques, so you can see what is covered and what is not.
What is the Pyramid of Pain?
A way to rank what you detect by how much it costs the attacker to change it. A hash is trivial to change. A technique is not. GarudaKavach focuses on the top.
What happens every night?
On its own, GarudaKavach sweeps your infrastructure's logs for TTPs and IOCs, so slow beacons and quiet footprints that no single alert showed are not missed.
Does it replace my SOC team?
That is where it is heading: GarudaKavach is built to replace L1, L2 and L3 work, soon. Today your people review the verdicts and decide what to do, and it never acts on a device.
Who sees what?
Managers, CISOs and clients each have their own dashboards, built for the question each of them asks.
What if one of its own services gets stuck?
Every service shows green or red from its real health. A stuck service restarts itself, and you can restart it from the console.
How do we start?
Run the gap check, send us the result, and we will arrange a walkthrough.