For security engineers who run the SIEM
Parser fallback and raw log retention
A format change should be visible to the team responsible for collection. ARRTECH SIEM supports chained parsers and keeps the raw log for review.
Evaluating a SIEM’s source handling
Integration lists rarely say who fixes a connector when a vendor changes its format.
The useful questions are how a custom source is parsed, how fields are mapped and what a search looks like.
Scripting, APIs and Linux hosting
Search takes a pipeline of functions, playbooks accept Python, and every product has a REST API.
Deployment planning covers supported server platforms, sizing and patching responsibilities.
A pilot with one custom source
The pilot takes a source no connector covers and builds its parser from a sample log.
The parsed fields, mapping and query are visible before anything else changes.
Questions before a build
How do we onboard a source no connector covers?
The ARRTECH SIEM agent reads databases, WMI and Kafka remotely. If ARRTECH does not read a log source yet, we add a parser at no charge during the contract.
Why does every product name the same event differently?
SIEM classification rules map vendor event codes into common categories, so searches and rules can connect activity across supported sources. MITRE ATT&CK tactic and technique are searchable columns.
What does a search actually look like?
Searches use a base search and a pipeline of functions after a pipe. Saved queries feed rules, dashboards and reports, with the original records available for inspection.
What happens when a step needs a script?
ARRTECH SOAR playbooks accept Python steps. Every SOAR playbook declares JSON input and output schemas and can be tested on sample data first.
What will we have to size and patch?
ARRTECH SIEM runs on supported Linux platforms and scales across servers. Cyberdroid AI Detection, available now to select organizations, uses CPU hardware sized for the data and workload.
What runs automatically?
The ARRTECH SOAR playbooks the team builds, with approval at the steps the team marks. AI Detection raises findings for analysts to investigate.
