Assessment
A rule on a dashboard is not the same as a rule that fires. We measure every detection at four levels and show you where coverage drops.
Snapshot or assessment
Coverage model
A detection only protects you when it passes all four levels. Most gaps sit between the first and the last.
Is there a rule for this behaviour?
How we check: We read the rule set in your SIEM.
Is the rule switched on?
How we check: We compare the rule's state with your intended coverage.
Is the data the rule needs still arriving and parsed correctly?
How we check: We check each agreed log source for gaps and format changes.
Does the rule actually fire on the behaviour it targets?
How we check: We run a controlled test and record whether the alert appears.
Report preview
Every finding names the level where a detection fails and what to fix first.
Illustrative data. Not from a customer environment.
Most sample rules exist and are enabled. Coverage drops at data health and validation.
| Detection | Rule exists | Rule enabled | Data healthy | Validated |
|---|---|---|---|---|
| Encoded PowerShell command | Yes | Yes | Yes | Yes |
| New admin account created | Yes | Yes | Yes | Not tested |
| Impossible travel sign-in | Yes | Yes | No | Not tested |
| Mailbox forwarding rule added | Yes | No | Yes | Not tested |
| Lateral movement over remote services | No | No | No | Not tested |
FAQ
A SOC assessment measures whether your security operations would catch an attack: which log sources reach your SIEM, whether that data is healthy, and which detections exist, are enabled, have the data they need and have been validated. SOCGenX reports each detection at one of those four levels, with a prioritized gap list.
Each detection is mapped to the MITRE ATT&CK techniques it is meant to catch, then checked at four levels: the rule exists, it is enabled, the data it needs is healthy, and it has been validated to fire. Coverage is reported per level, so a technique with only a disabled rule is not counted as covered.
It includes one. The free snapshot is read-only: it inventories your log sources, scores the health of each source and shows which rules exist and are enabled. The full assessment adds validation, which shows the detections that really fire.
Read-only access through your SIEM's own API. Raw logs stay in your environment; the snapshot works from rule, alert and source-health metadata.
Start with a free snapshot, or ask for a full assessment of your SIEM.
