Two ways to run ThirdEYE
Use it as your SIEM and SOAR with devices onboarded directly, or keep your tools and let its AI agents analyse the alerts they send. Many teams start with one and add the other.
Mode 1: as your SIEM and SOAR
Use ThirdEYE as the platform itself. Devices send their events to it, rules and correlation raise alerts, AI and agents investigate, and playbooks respond. No separate SIEM or SOAR is needed.
- No per-EPS charge. Ingestion is not priced by events per second or by gigabytes.
- Built for up to 5,000 events per second. That is the design target. In our scale test the ingest API sustained about 1,300 to 1,400 events per second with no lost or duplicate events, on a single process with SQLite. We have not yet benchmarked 5,000 end to end, so confirm on your hardware before you size for it.
- Any device that can send JSON over HTTP, plus ready Windows, Sysmon and Linux collectors. A device that only speaks syslog needs a small forwarder in front of it, because there is no built-in syslog listener.
- Free, open-source stack. The open Sigma rule set, open-source components and local AI models keep licence and AI cost at zero.
- Keeps working. Database fallback and sync-back protect the data if the primary database is down.
What Mode 1 uses
- Windows and Sysmon collectors, Linux agentPartly built
- Any device over HTTP (JSON ingestion API)Configurable
- Detection rule catalog (103 built in, 1,293 Sigma)Available
- CorrelationAvailable
- MITRE ATT&CK mappingAvailable
- SOAR playbooksAvailable
- Case managementAvailable
- Ingestion throughputPartly built
Mode 2: as an AI agentic SOC for all your alerts
Keep your existing security tools. Send their alerts to ThirdEYE from any security device, and the agents analyse each one: reuse earlier conclusions, enrich the indicators, map to ATT&CK, ask an LLM when rules are not enough, decide, and hand the outcome to a case, playbook or ticket.
- No cap on alert count. Rules and remembered analyses clear known patterns without a model call, so volume does not mean model cost.
- LLMs and rules together. Five providers and local models, with a six-step fallback chain that ends in built-in rules, so analysis never stops. Provider quotas still apply to the hosted models you connect.
- Any security device. Anything that can send an alert over HTTP, and ready connectors for common SIEMs.
- Agents and MCP. 13 agents, 23 MCP server tools and a 38-tool gateway, with every action tool approval-gated. Live response stays off until you enable it.
What Mode 2 uses
- Alerts from any security device over HTTPConfigurable
- Automatic investigation of every alertAvailable
- Rules and memory first, no LLM call neededAvailable
- LLMs with a six-step fallback chainConfigurable
- MCP toolsConfigurable
- Response actionsConfigurable
- Cases and ticketsAvailable
Not sure which fits?
No SIEM yet
Start with Mode 1. Onboard a few device groups and use the built-in rules.
Already run a SIEM or EDR
Start with Mode 2. Forward alerts and measure how much triage time the agents save.
Both
Onboard new device groups directly and route the rest through your existing tools. One alert model, one case view.
Tell us your stack and your event volume.
We will say which mode fits, what it needs, and how to measure throughput on your own hardware.