Use cases
When detection is all your SIEM does
Some organizations couldn’t remove their SIEM if they wanted to. It holds compliance reporting, ticket workflows, dashboards three other departments depend on. Pulling it out would be a rebuild nobody asked for.
That isn’t everyone.
If your retention already lives in S3 or a lake, your tickets live in Jira or ServiceNow, and nobody outside the security team logs in — then your SIEM is a detection tool, and your SIEM bill is a detection bill.
How spotr.io does it
Your sensors stay. EDR, cloud logs, an on-prem NDR — we want their output.
Your retention stays. We sink enriched data to S3, Snowflake, or wherever it already goes.
Your workflow stays. Results land in Slack, Teams, ServiceNow.
Your detections come with you. Sigma and Elastic translate straight across. Anything else you’ve built, bring it along and we’ll add it in.
How you’d prove it. Point one source at us — something you’re already collecting. Run it alongside what you have for as long as you need.
We’ll show you the clock for every step: when the event was generated, when we received it, enriched, detected, qualified, investigated, contained.
Then ask your SIEM for the same breakdown.
Multi-Cloud Detection Use Case
Every major cloud provider ships built-in threat detection — AWS has GuardDuty, Microsoft’s Azure has moved Sentinel under their Defender offering, and Google has Security Command Center. They work well enough inside their own walls. But they were built to protect their cloud, not yours-across-three.
When you try to stretch them across environments, you hit real limits. Sentinel can ingest AWS and GCP data, but those sources are second-class citizens — different schemas, separate parsers, and detection rules that were written for Azure first. GuardDuty and SCC don’t even try. And Google SecOps, the strongest streaming architecture of the three, caps multi-event detection rules at 75.
Meanwhile, the attacks that actually matter don’t respect cloud boundaries. A compromised identity in Azure AD that pivots to an AWS S3 bucket through a GCP-hosted application looks like three unrelated low-priority events — unless you can correlate them in real time across sources.
How spotr.io does it
spotr.io treats every data source as first-class. AWS CloudTrail, Azure Activity Logs, GCP Audit Logs, on-prem syslog — all normalized on stream, enriched in flight, and evaluated against thousands of concurrent detections sub second. No 75-rule cap. No cross-cloud schema headaches. No trusting one cloud vendor’s security tool with a competitor’s data.
One engine. Any source. Real-time detection that doesn’t degrade the further you get from a single vendor’s ecosystem.
Sequence Detection
Attacks are multi-step. Phish → macro → C2 → credential dump → lateral movement → exfil. The kill chain crosses every boundary — endpoint, network, cloud, identity. But every tool in the stack only sees its piece.
EDR sequences within the endpoint — blind to network and cloud. NDR sees traffic — can’t link it to the process or user. XDR promises to unify but only sequences within one vendor’s ecosystem. CrowdStrike XDR sees CrowdStrike data. Palo Alto XDR sees Palo Alto data. Cross-vendor? Still your analyst, manually, hours later.
SIEMs are worse — single-event rules with no ordering, no negation, no state. They can count (“5 failed logins”) but can’t express “A then B then NOT C, within 10 minutes, by the same user.” And they run on a schedule, not in real time.
The result: each tool fires its own alert on its own step. Nobody detects the chain. Your analyst reconstructs it by hand across 3–4 consoles — if they catch it at all.
How spotr.io does it
Sequence detection models define multi-step, ordered event chains with time windows, entity correlation, and negation — all evaluated in real time on the stream. Vendor-agnostic. Auth logs, endpoint telemetry, network data, cloud events, identity systems — one model, one detection, across all sources.
Negation is native: “login from new geo BUT no MFA challenge” detects what didn’t happen. Time windows enforce ordering: “A before B, within X minutes, by the same entity.” Cross-source correlation means a single sequence can span Sysmon events, firewall logs, Okta auth, and AWS CloudTrail.
The state engine tracks active sequences as they unfold in real time. The detection fires the moment the chain completes — not on the next hourly batch run.
The Conversation
“Can any single tool in your stack detect a multi-step attack across endpoint, network, cloud, and identity?” — Almost always no.
“Can it express ordering and negation in one rule?” — That’s where they go quiet.
“How long does it take your analysts to reconstruct a kill chain across your tools?” — Hours. If they catch it at all.
“What if the kill chain was one detection, across all sources, in real time?” — That’s spotr.io.
Ransomware Early Warning Use Case
Colonial Pipeline — $4.4M ransom, fuel shortages across the East Coast. JBS Foods — $11M ransom, meat processing shut down nationwide. MGM Resorts — $100M+ in losses, casinos dark for days. In every case, the encryption event was the last step in a chain that started days or weeks earlier. Initial access. Credential harvesting. Reconnaissance. Lateral movement. Privilege escalation. Data staging. Exfiltration. Then — and only then — encryption.
Your EDR is optimized to catch the payload. But modern ransomware groups disable EDR before deploying it. Your SIEM runs a search an hour later — after the encryption is already running. By the time you see the alert, the damage is done.
How spotr.io does it
spotr.io detects the attack chain, not the payload. The pre-encryption sequence is where ransomware is stoppable — and it follows predictable patterns. Credential access tools appearing on hosts that have never seen them. Lateral movement velocity spiking across the network. Service accounts authenticating to systems they’ve never touched. Reconnaissance commands (net group, nltest, AdFind) clustering on a single host. Shadow copy deletion. Backup service disruption. Each event alone might be noise. The sequence — correlated across identity, endpoint, and network in real time — is unmistakable.
Threshold models catch volumetric indicators like mass file renames or rapid encryption spread. Anomaly models catch behavioral firsts — a service account that never left one server suddenly touching fifty. Sequence models catch the full kill chain: initial access → discovery → lateral movement → privilege escalation → defense evasion → impact. And because spotr.io operates on stream, detection happens in seconds — not after the next scheduled search.
EDR catches the ransomware binary. spotr.io catches the attacker building toward it.
The best time to stop ransomware is before the ransom.
Insider Threat Use Case
External attackers have to break in. Insiders just log in. They already have credentials, access, and context — and they don’t trip a single perimeter alarm. The Tesla saboteur who exfiltrated gigabytes to personal cloud storage. The Capital One engineer who pulled 100M customer records using internal access. The Twitter employees who hijacked high-profile accounts for a crypto scam. No malware. No exploit. Just legitimate access, used illegitimately.
Your SIEM sees a login. Your DLP sees a file download. Your EDR sees… nothing suspicious. Each event is normal. It’s the pattern across days and systems that reveals intent — and batch queries over siloed data can’t connect those dots in time.
How spotr.io does it
spotr.io correlates behavior across identity, data access, endpoint, and network in real time. Detect when a user on a performance improvement plan starts accessing repos they haven’t touched in months. Flag when download volume spikes 10x above a user’s own baseline in the week after they give notice. Catch off-hours access to sensitive systems from users who’ve never worked late. Track credential sharing, privilege escalation patterns, and data staging across cloud storage — all as it happens, not in a post-incident forensic review.
Threshold models catch volume spikes. Anomaly models catch behavioral deviation from self and peer baselines. Sequence models catch the multi-step data staging playbook: enumerate → collect → stage → exfil. And because spotr.io maintains state continuously, low-and-slow exfiltration over weeks doesn’t disappear between scheduled searches.
DLP tells you data moved. spotr.io tells you why it’s suspicious.
The most expensive breach doesn’t come through your firewall. It comes through your front door.
Identity Use Case
Cloud accounts are now the #1 MITRE ATT&CK technique — dethroning PowerShell for the first time (Red Canary 2025). Identity attacks grew 4x year over year. The perimeter isn’t the firewall anymore — it’s Okta, Entra ID, and Active Directory.
But most orgs treat identity logs like any other data source: ship them to the SIEM, run a few simple rules. “5 failed logins.” “Impossible travel.” That’s it. The impossible travel rule fires on every VPN reconnect, every airport WiFi, every phone switching from cellular to broadband. It’s noise, not detection.
Worse, there’s no cross-source correlation. Your IdP knows someone logged in from a new location. Your EDR knows a suspicious process ran. Your cloud logs know a sensitive resource was accessed. But nobody connects those three events into one story because they live in three different tools.
And it all runs on a schedule. A compromised credential can be used for hours before the next batch search catches the initial login.
How spotr.io does it
All identity sources — Okta, Entra ID, AD, Duo, LDAP — stream alongside endpoint, network, and cloud data. One pipeline. One detection engine.
Cross-source sequence models connect the full chain: auth event → endpoint action → cloud resource access. Behavioral baselines learn per-user patterns continuously — login times, access patterns, privilege usage. Negation catches what didn’t happen: “login from new geo BUT no MFA challenge.”
Eight identity-specific detection types out of the box: credential stuffing, account takeover, impossible travel (with real context, not just geo), privilege escalation, first-time access, MFA bypass, dormant account usage, and lateral movement via identity.
The AI SOC Analyst presents identity signals with full context — who, from where, what they accessed, what’s abnormal, and why it matters.
The Conversation
“Cloud accounts are the #1 attack technique. How are you detecting identity-based attacks today?” — Most will say impossible travel and failed login thresholds.
“Can you correlate an auth event with what that user did next on the endpoint and in the cloud?” — Almost nobody can.
“What if every identity event was correlated with everything else, in real time, with behavioral baselines?” — That’s spotr.io.
MSSP Margin Multiplier Use Case
Your SOC runs the show. We power the detection.
Problem: MSSPs are in a margin fight. Everyone runs the same stack — same SIEM, same rules, same SLA. SIEM costs scale with data, analyst costs scale with alerts, and both keep going up. You’re competing on price, not capability.
Where spotr.io changes the game
Detection your SIEM can’t do — streaming anomaly, sequence, behavioral. Tens of thousands running sub-second. Depth no competitor offers.
Margin expansion — offload detection from SIEM → reduce ingest → costs drop. AI triage handles first pass → analysts focus on real threats.
Scale without hiring — new customers connect in minutes, autonomous coverage activates detections automatically. More customers, same team.
Your stack stays yours — feeds better signals to existing SOAR/AI. Import existing Sigma/Splunk/Elastic rules. Nothing gets ripped out.
The Revenue Angle
Reduce SIEM costs (keep savings or pass on)
Offer premium detection tiers as upsells
Onboard faster = faster revenue
Retain longer = stickiness from detection competitors can’t match
Scale book without scaling team.
The Conversation
“What’s different about your detection versus every other MSSP?” → If you run the same SIEM with the same rules… nothing.
“What if you could offer detection your competitors literally can’t?” → Real-time streaming, multi-step chains, behavioral anomalies. Natively, at scale.
“And what if it also cut your costs?” → More margin, not less.
