Capability · Threat Hunting

Hunt across every event, tagged to MITRE ATT&CK.

The signal is almost always already in your logs. Finding it should not require a query language and a free afternoon. Suriq retains your detections and events and makes them searchable by host, rule, severity, and source - and tags every detection with its MITRE ATT&CK tactic and technique, so a single odd event becomes a thread you can pull on.

The problem

The evidence is there. Getting to it is the hard part.

Hunting a threat usually means stitching together raw logs across hosts in a query language you half remember, before the data ages out of the index. The work is so heavy that most teams only do it after an incident, never before.

The Suriq way

Every event, searchable

Detections and logs are retained and searchable by host, rule, severity, category, and source - filtered in plain terms, with no SPL or KQL to learn.

Tagged to the playbook

Every detection carries its MITRE ATT&CK tactic and technique, so you can pivot from a single signal to the wider pattern instead of guessing what it belongs to.

From signal to incident

Repeat events are deduplicated into incidents, with the assistant a question away to explain what you are looking at and what to check next.

Turn a hunt into a rule

Found a pattern worth watching for? Turn it into your own rule for file changes or host activity, and it runs going forward alongside the managed detection rules Suriq maintains for each host.

Side-by-side

Legacy stack vs. Suriq

Dimension	Legacy	Suriq
Search	SPL / KQL required	Plain filters
Framing	Raw events	MITRE-tagged
Pivot	Manual joins	Correlated into incidents

Retain and search every event.

Keep your detections and logs and search them fast, on a dedicated backend, with nothing aging out from under your hunt.

Capability

Incident response, with context in hand.

Detections bundled into one correlated incident, tagged to MITRE, routed to on-call, and explained in plain English.

Capability

Know the instant a critical file changes.

Watches the files that matter for every change, tags the suspicious ones to MITRE ATT&CK, and lets you baseline out the noise.

FAQ

Frequently asked questions

Do I need a query language like SPL or KQL to hunt in Suriq?

No. Your detections and logs are retained and searchable with plain filters - by host, rule, severity, category, source, IP, user, or free text - so you hunt by narrowing a form, not by writing SPL or KQL. Read the exact matching events in seconds.

What can I hunt across?

Your detections and events are retained and searchable on a dedicated backend, so a hunt is not racing the data out of a hot index. Filter across every host and rule, pivot from one signal to the related activity, and keep old events ready to action instead of ageing out.

How does MITRE ATT&CK tagging help a hunt?

Every detection carries its MITRE ATT&CK tactic and technique, so a single odd event becomes a thread you can pull on. You pivot from one signal to the wider pattern instead of guessing what it belongs to.

Can I turn a hunt into a detection rule?

Yes, for file changes and host activity. You can turn a pattern you found into your own rule that runs going forward, alongside the managed detection rules Suriq maintains for each host.

Are related events grouped into one incident?

Yes. Repeat detections are deduplicated into a single incident with the evidence attached, and the built-in assistant explains what you are looking at and what to check next. You decide what to do.

See what Suriq finds on your own servers.

Agentless checks for uptime and your cloud, a lightweight agent for detection on each server, and one console that ranks and explains what it finds.

Get Access How it works