Shieldlix Detection Engine

37,000+ detection rules across 60+ threat families. Threshold, correlation, and anomaly detection mapped to MITRE ATT&CK.

Architecture

Loading diagram...

Technology Stack

Rust
Core runtime — memory-safe, zero-cost abstractions, no garbage collector
Tokio
Async runtime — Kafka consumer with real-time event processing
Kafka
Event streaming — durable alert pipeline, exactly-once semantics
Rule Engine
Threshold, correlation, anomaly — 37K+ rules with template expansion
Risk Scorer
Per-rule risk scoring (1-100) with incident aggregation
MITRE Mapper
Tactic/technique mapping for coverage analysis and gap detection
Next.js 16
React 19 SSR/SSG — streaming, server components, optimistic UI
React 19
UI framework — concurrent rendering, transitions, Suspense

Core Features

Threshold Rules

Fire when event count exceeds a threshold within a time window for a specific entity.

🔗

Correlation Rules

Fire when an ordered sequence of event types occurs for the same entity within a window.

📈

Anomaly Rules

Fire when event volume deviates from statistical baseline (mean + N*standard deviation).

🎯

MITRE ATT&CK Mapping

Every rule maps to MITRE tactics and techniques for coverage analysis.

📊

Risk Scoring

Each rule generates risk scores (1-100). Incidents aggregate scores per entity.

👥

Entity-Centric

Process events per entity (user, host, IP, device, service). Maintain per-entity baselines.

📚

37,000+ Rules

Curated catalog across 60+ threat families. Template expansion generates rule variants.

🔄

Incident Grouping

Group alerts by tenant + entity + 24h bucket. Compute cumulative severity.

Detection Rule Types

Threshold

N events in T seconds

20+ failed logins in 5min

Score: 25

Correlation

Event A then B then C

Failed login then success

Score: 35

Anomaly

Count > mean + N*stddev

Spike above 3-sigma baseline

Score: 30

Threat Families (20 of 60+)

AuthenticationEndpointNetworkDNSCloudSaaSData ExfiltrationLateral MovementPrivilege EscalationDefense EvasionPersistenceCollectionCommand and ControlImpactCredential AccessDiscoveryExecutionInitial AccessReconnaissanceSupply Chain

Risk Severity Mapping

Critical
>= 90
High
>= 60
Medium
>= 30
Low
< 30

How Shieldlix Compares

Feature
Shieldlix
Splunk ES
Elastic
MS Defender
Pricing
Free. 37,000+ rules included.
ES Premium required for advanced detections.
Free tier + paid ML features.
Included with M365 E5 ($57/user/mo).
Rule Count
37,000+ rules across 60+ threat families
1,700+ curated detections
Pre-built + custom detection rules
1,000+ built-in detections
Detection Types
Threshold, correlation, anomaly — all included
RBA, Notable Events, ES correlation
Threshold, machine learning, threshold alerts
Scheduled analytics, near-real-time, ML
MITRE ATT&CK
Tactic/technique tags on every rule. Coverage API.
Full matrix with gap analysis
MITRE framework mapping
MITRE in Threat Analytics
Risk Scoring
Per-rule risk scores (1-100) with incident grouping
Full RBA with dedicated risk index
Risk scoring via custom rules
Incident graphs with risk levels
Template Expansion
Generate rule variants from templates. 37K+ from base rules.
Manual rule creation required
Rule templates available
Pre-built analytics rule templates
Entity Tracking
Per-entity baselines (user, host, IP, device, service)
Entity risk framework with identity correlation
Entity analytics with ML
Entity behavioral analytics
Incident Grouping
Automatic: tenant + entity + 24h bucket
Notable event aggregation
Alert grouping rules
Incident correlation
Deployment
Kafka consumer. Self-hosted. No vendor lock-in.
Splunk Enterprise + ES. Complex.
Elasticsearch cluster required.
Azure SaaS only.
Customization
YAML rule definitions. Custom threat families.
Custom correlation searches (SPL)
Custom detection rules (EQL/KQL)
Custom analytics rules (KQL)

Cost Comparison

Annual detection platform costs by fleet size. Shieldlix is always free.

Fleet Size
Splunk ES
Elastic
MS Defender
Shieldlix
500 endpoints
~$50,000/yr (ES)
~$12,000/yr
$342,000/yr (E5)
$0
2,000 endpoints
~$50,000/yr (ES)
~$24,000/yr
$1,368,000/yr (E5)
$0
10,000 endpoints
~$50,000/yr (ES)
~$48,000/yr
$6,840,000/yr (E5)
$0

Detect every threat

Free forever. No credit card. No usage limits.

Splunk ES requires premium licensing. Shieldlix is free.