Every finding, with the evidence behind it — and yours to export
Managed detection is often a black box: an alert arrives, the investigation is closed with no reasoning, and when you ask for the logs there are none to give. A finding you cannot inspect is a finding you cannot defend to a client, an insurer or a court.
How KIROSEC answers it
Alert to evidence in one click
Every alert lists the events that raised it and opens them in the timeline. Each carries the rule version and ATT&CK technique that matched.
A chain of custody, recorded
Every imported file keeps its SHA-256 hash, the parser and version that read it, and the archive it came from. The case audit log is hash-chained.
Export what the filter selects
Export the events on screen — every page of them — as CSV or JSON Lines, each row carrying its source hash and parser version. A redacted export masks users, hosts, addresses and command lines for sharing outside the team.
Hand over a whole case
Export a case as an encrypted (AES-256-GCM, Argon2id) bundle signed with your device key, optionally redacted, for another analyst or a client to verify and open.
Where it stops
- Bundle signatures identify the signing device's key; there is no organisation-wide certificate chain yet.
- Exports and bundles cover what was imported into the case. KIROSEC does not hold copies of the original systems' logs.
Detections that apply
Browse the full detection libraryQuestions
- Can I get the raw events out of KIROSEC?
- Yes. Export any filtered set of events as CSV or JSON Lines, or the whole case as a signed bundle. Every export is recorded in the case audit log.
- Is the original log line kept?
- Yes. Every event keeps its original raw message and payload alongside the normalised fields.
Related problems
See it on your own logs
Bring an incident your current tools struggle with. We will show you how KIROSEC handles it, on your machine, with nothing leaving it.