Sentrix turns plain-English attack descriptions into production-ready Sigma, KQL, SPL, and EQL rules — mapped to MITRE ATT&CK, ready to deploy.
From live CISA KEV advisories to deterministic AST clause verification, Purple-Team bypass hardening, and SIEM FinOps query cost optimization.
Synthesise true-positive attack payloads and benign twins automatically. Verify every rule predicate deterministically and patch attacker CLI bypasses in one click.
Grades every Sentinel KQL, Splunk SPL, and Sigma rule from A+ to F for compute load. Automatically replaces expensive substring scans and unbounded joins.
Select any live CISA KEV vulnerability or paste a CTI blog to auto-compile a SIEM query + verified attack/benign unit tests + GitHub Gist Detection-as-Code bundle.
Bind Sentrix to your exact custom SIEM table and column names (DeviceProcessEvents, SecurityEvent, Splunk CIM tstats, or Elastic ECS) across all rule generation.
Interactive coverage heatmap across all 14 Enterprise tactics. Pinpoint critical Technique blind spots and forge schema-bound rules in seconds.
Highlight threat intel anywhere on the web with the Sentrix Chrome Extension, triage alerts on iOS & Android, or automate rule validation in GitHub Actions.
Pick a live CISA KEV vulnerability, paste a threat report, or describe an attacker TTP in plain English.
Sentrix compiles your SIEM rule, replays synthetic attack + benign twin events, and optimizes query compute cost to A+.
Export a complete Detection-as-Code JSON/YAML bundle or push directly to GitHub Gist, Sentinel, or Splunk.
Start free forever, or unlock unlimited Purple-Team Evasion Simulation, SIEM FinOps Optimization, and multi-tenant MSSP workspaces.
Essential AI rule generation and SigmaHQ browsing for individual SOC analysts.
Full Detection Forge, Purple-Team Dual-Payload Replay & SIEM FinOps Optimizer.
Multi-tenant detection engineering, team RBAC, and automated GitHub PR pipelines.
Full REST API with Swagger docs, Chrome/Edge Browser Extension, and installable iOS/Android Mobile Web App.
curl -X POST \
https://sentrix.amanpreetmatharu.com/api/v1/generate \
-H "Authorization: Bearer ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"scenario": "Detect LSASS credential dump",
"platform": "Microsoft Sentinel (KQL)",
"severity": "Critical"
}'
{
"rule": {
"title": "LSASS Memory Credential Dumping",
"mitre_id": "T1003.001",
"quality_score": 96
}
}Forge, simulate, FinOps-optimize, and ship production SIEM detections in seconds.