Ten functions in one workflow. Three it leaves to specialists.
Teams often run a separate tool for each of these jobs. ThirdEYE handles them in one pipeline, with an honest label on how far each one goes.
Functions covered
The middle column is the kind of standalone tool teams usually buy for the job. It describes the category, not a claim about any named product.
| Function | Usually a separate tool | What ThirdEYE does | Status |
|---|---|---|---|
| Alert triage and investigation | SOC analyst triage, AI SOC assistants | Automatic investigation with rules and memory first, a model second, and a logged justification. | Available |
| Detection rules and correlation | SIEM rule engine, correlation | 1,396-rule catalog, a visual builder and cross-alert correlation. The visual rule builder is a UI feature without a dedicated backend test. Sigma rules belong to their authors under the Detection Rule License 1.1 and must be attributed. Counted by loading the catalog. | Available |
| Playbooks, approvals and rollback | SOAR | 58 built-in playbooks, a builder and an AI drafter that waits for review. Live actions are opt-in. | Available |
| ATT&CK-guided runbooks | Runbook libraries | 1,412 Investigate and Respond workflows across 706 techniques. All manual. Generated from templates plus per-technique data, not hand-written per technique. MITRE ATT&CK is (c) The MITRE Corporation, used under the ATT&CK Terms of Use. | Available |
| Case management | Case and incident management | Cases with tasks, SLA tracking, evidence chain and reports. | Available |
| User and entity behaviour analytics | UEBA | Statistical anomaly scoring on user and host activity, feeding the same pipeline. | Available |
| Threat-intelligence enrichment | Threat intelligence lookups | VirusTotal, AbuseIPDB, Shodan and OTX enrichment with your own keys. Each provider needs its own API key. | Configurable |
| Threat hunting | Hunting workbenches | Ad-hoc queries over connected sources with AI-assisted suggestions. Depends on which data sources are connected. Not separately covered by an automated test in this review. | Configurable |
| External attack surface (passive) | Attack surface monitoring | Passive recon using Shodan and HTTP-header checks. Needs a Shodan key for full results. | Configurable |
| Operations dashboards | SOC reporting and dashboards | KPIs, timeline, severity mix, attack vectors and AI confidence from database-side counts. | Available |
Covering a function does not mean matching a specialist product feature for feature. It means the job can be done inside the same workflow.
What it deliberately leaves to specialist tools
Large-scale log storage and search
ThirdEYE keeps the alerts and events it ingests, but it is not positioned as a replacement for the log platform that holds your long-term data. Keep Elastic, Splunk or Wazuh for that.
Endpoint sensors and EDR
It does not collect telemetry from endpoints the way an EDR agent does. It can read from your EDR or SIEM and, if you enable live mode, call a response provider.
Network enforcement
Firewalls and network controls stay where they are. ThirdEYE can call them through a webhook provider when you allow it.
The scale behind it
Counted from the product, not estimated. Each number says what it does and does not mean.
- 13agents
- 8 control agents (triage, investigation, SOAR, UEBA, dark web, compliance, threat hunter, auto-remediation) and 5 specialists. Depth varies by agent. See details
- 1,412ATT&CK workflows
- An Investigate and a Respond runbook for each of 706 MITRE techniques. All manual: an analyst approves, nothing runs by itself. See details
- 58built-in playbooks
- Plus 108 one-click prompts in 9 categories that make the AI generator draft new ones for your review. See details
- 1,396detection rules
- 103 written for the platform and 1,293 imported from the open Sigma project, with a visual builder for your own. See details
- 5LLM providers
- Groq, Gemini, Mistral, OpenAI and local Ollama. The default chain holds 10 hosted free-tier models before a paid or local one. See details
- 6step fallback chain
- Groq, Gemini, Mistral, OpenAI, Ollama, then built-in rules. Analysis degrades instead of stopping, and fallback results never auto-close an alert. See details
- 38MCP gateway tools
- 18 read-only enrichment, 5 investigation, 1 AI summary and 14 action tools that always need approval. Optional: ThirdEYE runs without it. See details
- 23MCP server tools
- Alerts, investigation, incidents, enrichment, playbooks, hunts and agent control, available to any MCP-capable AI client you connect. See details
- 2database modes
- A PostgreSQL cluster, or a local fallback that syncs back automatically when the primary returns. Recovery sync is tested; two-server failover is a documented design. See details
Check it against your own stack.
Tell us which tools you run today and we will say which functions ThirdEYE can take on, which it complements, and which it should not touch.