Threat Detection
Threat detection in System9 is a streaming and correlation surface built on open standards, correlated on the platform's own governed substrate so that identity, classification, and audit context travel with each event rather than being stripped on the way to a separate tool.
Open standards, not a black box
- OCSF on the wire. Security events are normalized to the Open Cybersecurity Schema Framework (an open event schema) so events are portable and legible rather than locked in a proprietary shape.
- Sigma for detections. Detections are expressed as Sigma rules: open, portable detection logic, so the rule set is inspectable and not a closed vendor secret.
- Governed and recorded. Each event is classified under the classification ladder, served through the same governed reads as any data, and correlated with results written to the activity ledger.
Figure: threat detection on open standards. OCSF normalization and Sigma correlation are the wired path (green); UEBA and DLP (amber, dashed) are a policy layer that does not inspect content and is not presented as an operating control.
Table equivalent
| Capability | Status | What is honest to say |
|---|---|---|
| OCSF event normalization | Wired | Open event schema on the wire |
| Sigma rule correlation | Wired | Open, portable detection rules |
| Recording on the ledger | Wired | Correlation results are tamper-evident |
| Detection catalogue | Customer-authored | Detections are written against your own estate rather than shipped as a fixed list |
| UEBA (behaviour analytics) | Policy layer only | No production caller; inspects nothing |
| DLP (data-loss prevention) | Policy layer only | At-rest DLP inspects nothing and reports clean |
| Network detection | Partial | Covers the named surfaces rather than the full network |
Related topics
- Security Operations overview, the pipeline this detection sits in.
- Incident response, what happens after a detection.
- Audit and tamper-evidence, the ledger correlation results are written to.