Parsers fail, records stay
Vendors change log formats without notice, and a parser that worked yesterday drops fields today. What matters then is that the raw record is kept, and that the parser is something you can read, chain and fix yourself.
Connector counts don’t tell you what breaks.
Every SIEM lists its integrations. Few say what happens when a vendor changes its format, or who fixes the connector when it does.
The questions that matter are about the mechanism: how a custom source is parsed, how fields are mapped and what a search looks like.
Open to code, on servers you control.
ARRTECH builds software engineers can inspect. Search takes a pipeline of functions, playbooks accept Python, and every product has a REST API.
The stack runs on Linux servers you size and patch, and nothing in it acts without a playbook your team built.
Build one custom source first. Replace nothing.
Start with the source no connector covers. A helper builds a parser from a sample log, and ARRTECH writes one at no charge under support.
You see the parsed fields, the mapping and the query before anything else changes.
Build
How do we onboard a source no connector covers?
The ARRTECH SIEM agent reads databases, WMI, Kafka and Microsoft 365 on remote systems without installing anything there. A helper builds a parser from a sample log, and ARRTECH writes one at no charge under support.
Why does every product name the same event differently?
Classification rules turn vendor codes into plain categories, so Windows event 4624 becomes successful login and one rule covers every vendor. MITRE ATT&CK tactic and technique are columns you can search and alert on.
What does a search actually look like?
The SIEM runs a base search followed by a pipeline of functions after |, and eql sends Elasticsearch SQL directly. Saved queries feed rules, dashboards and reports, and the REST API covers search, alerts and sources.
What happens when a step needs a script?
ARRTECH SOAR adds Python through a Custom Script node with up to five outputs, and every playbook declares JSON input and output schemas. You simulate a playbook on sample data, and action nodes are validated without executing.
What will we have to size and patch?
ARRTECH SIEM runs on Debian, Ubuntu or Red Hat, with search, correlation and reporting on separate servers that scale out. Cyberdroid AI Detection runs beside it on CPUs and reads the SIEM export from a read-only share.
What can act without us?
Nothing you did not build. AI Detection never blocks or changes anything, and ARRTECH SOAR acts only through playbooks your team builds. An Operator node emails a person up to five color-coded options and waits. The console audit log records logins, searches and configuration changes.
