CEDX SIEM · IT & Security
CEDX SIEM turns the event stream into a queue an analyst can finish: every alert triaged by an agent with a verdict — benign, true positive, needs human — and every verdict one click from being overturned.
The Overview counts the overturns. This week: zero accepted, zero overturned, 13 minutes median saved per alert. When a human corrects the agent, the number moves — that is the audit trail.
Runs on demo data — Northline Production is the software's sample tenant, not a customer.
What it is
Under the alerts sits the event stream: 320 events in the sample with action, actor, target and outcome — admin.role.grant, lateral.rdp, file.exfil, auth.mfa.challenge. 211 non-success, 95 policy-blocked denies, 27 critical severity.
320 alerts fired; the agent triaged all 320. Verdicts are explicit: benign 86%, true positive 93%, needs human 60–71% — and the ones marked needs-human are the queue a person actually works. Fatigue score rides alongside, so noisy rules surface as noise.
48 detection rules, 40 enabled, 8 flagged as high false-positive tune candidates. Standing-privilege-unused fired 90 times in 7 days at 85% false positive — the library tells you to tune it, in its own table.
Product tour
Not a mockup and not a concept deck. This is what opens at /app/siem.
01 — Overview
119 open alerts, 24 critical, 28 unowned, fatigue P95 at 52. The root-caused alerts read like a handover: a SEV-1 credential storm — brute force plus MFA fatigue plus lateral RDP in the same window — and a 4.2 GB off-hours bulk export sitting unowned.
02 — Events
Search actor, action, target or IP and read the stream itself: break-glass-ops failing a lateral RDP, svc-billing denied on a DNS query, a phish report arriving as its own event type. The queue above is only ever a summarisation of this.
03 — Alerts
Impossible travel on samir.patel is critical and contained, risk 99, needs-human 60%. The BEC signal on the same principal has fired 79 times with a fatigue score of 71 — the table shows both numbers so the tuning conversation starts from evidence.
04 — Detections
The rule table sorts by fires: vpn-new-device-22 at 110 fires and 51% false positive, geo-impossible-travel-10 at 103 fires and 14%. The 8 rules over 50% false positive are marked tune candidates — the library owns its noise.
Who runs it
Roles, not references. We have no named customers yet, so nobody in these photographs is quoted, credited or claimed as one.
Works the needs-human queue by risk and fatigue, overturns the agent when it is wrong, and owns the 28 unowned criticals.
unowned open · 28
Lives in the rule library: tunes the 8 high-FP candidates, watches fires against false-positive rate, and retires rules that only produce fatigue.
tune candidates · 8
Takes the contained criticals — impossible travel, credential storm — and runs them to closure with the event stream as the evidence.
SEV-1 · credential stormThe shape of it
Every figure below is legible in the captures above. Nothing here is a projection of your estate — it is the state of the demo data.
How it runs
The stream lands as events — 2.4M in 24 hours — with actor, action, target and outcome preserved, so nothing downstream has to guess.
48 rules score the stream into 320 detections; each rule carries its own false-positive rate, so noise has an owner.
The agent puts a verdict and a confidence on every alert — benign, true positive, needs human — and the median triage lands at 18 minutes.
A person corrects the agent and the counters move: accepted, overturned, time saved. The queue remembers who was right.
One record
An alert about a device, a login or a flow means more when the device, the identity and the path are the same records the rest of the estate keeps.
Endpoint detections arrive with the agent verdict attached — malicious 92% on the credential-dump attempt is the same row the fleet screen shows.
CEDX NetworkThe lateral-RDP and east-west events in the stream are the flows Network governs — policy denies land here as 95 blocked outcomes.
CEDX AccessBreak-glass and standing-grant activity is Access's record; when it appears in the event stream, the grant is one click from the alert.
CEDX ITSMA contained critical becomes an incident with a commander when it has to — the credential storm is already root-caused for the handover.
Limits
Finding this out on the third call is worse for you than reading it here, and worse for us.
Start
Open it right now
Your streams, your rules
SIEM with the rest of it
Questions
Yes. Every screenshot is a capture of the running build and you can open the same build at /app/siem. It runs on demo data — Northline Production is the sample tenant.
Every alert gets a triage verdict with a confidence — benign 86%, true positive 93%, needs human 60–71%. The needs-human verdicts form the queue a person works; the accepted and overturned counters on the Overview record how often a human agrees.
Fatigue is a score on the alert row, and the rule library prints fires against false-positive rate — the 8 rules over 50% are flagged as tune candidates. The standing-admin rule that fired 90 times in 7 days is exactly what that screen exists to catch.
Yes — the Events screen is the stream underneath: searchable by actor, action, target and IP, with timestamps to the second and success, failure and deny as separate outcomes.
No certification has been issued. What we can evidence about hosting, encryption, tenant isolation and retention is written up on the security page.
Live build, demo data, no card. Then ask what your own fatigue P95 would be.