Start with onboarding
A reason to investigate
Rule health and available verdicts help the team choose where to look.
MSSP/MDR · Deliver the service
Keep customer detections ready.
Find the rule or feed that needs work.
Virtus Optimus maintains detection rules across connected security tools. Give your detection engineers evidence of noisy or silent rules, trace stopped ingestion and build missing coverage with changes they can test and review; Optimus requires its own license entitlement.
Rule health and ATT&CK coverageStopped ingestion and parser drift14,000+ detection rules from eight community sources
OptimusNorthstar
WatchNorthstar
- Technology
Microsoft Sentinel- Rules
- 142
- Silent
- 9
- Coverage
- MITRE ATT&CK
Silence is a reason to investigate, not proof of a broken rule.
OptimusHarbor Retail
WatchHarbor Retail
- Technology
- Splunk
- Rules
- 88
- Noisy
- 3
- Coverage
- MITRE ATT&CK
Noise findings depend on available analyst verdicts and rule matching.
OptimusHarbor Retail
Broken Pipe
Okta feedEvents to Splunk
Ingestion stoppedEvidenceNo new events in the sample window
Root CauseRecorded data shows an ingestion gap
A valid rule needs the data it is written to detect.
Evidence
- Technology
- Splunk
- Source
- Okta
- Issue
- Stopped ingestion
- Next step
- Inspect the source feed
The explanation follows the recorded facts. Missing evidence calls for a diagnostic step.
OptimusNorthstar
Design
Optimus ArchitectOAuth consent grants to unknown apps
Connected technologyMicrosoft Sentinel
Microsoft SentinelAvailable schemaAuditLogs / OperationName / TargetResources
Proposed detectionConsent activity for review
CheckedArchitect
- Request
- OAuth consent activity
- Schema
- Harvested from target
- Existing content
- Review before authoring
- Deployment
- After testing and review
- Model provider
- Configured
The schema names are illustrative. Authoring is grounded in the connected technology’s data.
OptimusNorthstar
Design
OAuth consent activityProposed detection
SimulateCheck against the target
Simulated OKApproveReview the proposed change
ApplyRequires supported target operations
Settings
- Technology
- Microsoft Sentinel
- Autopilot
- Off
- Auto-deploy Library
- Off
- Live test
- On
- Library rules
- Separate opt-in
Autopilot applies eligible low-risk fixes for opted-in technologies, allowed fix types and passed simulations.
Autopilot applies eligible low-risk fixes only for opted-in technologies, allowed fix types and passed simulations.
Watch shows rule health and coverage for connected technologies. Inspect a separate customer view for each tenant.
Broken Pipe brings evidence of stopped ingestion into view. A silent rule by itself does not prove broken detection logic.
Optimus Architect grounds a proposed detection in a connected technology’s available schema.
The manual path separates simulation, approval and application. Autopilot and Library auto-deploy are separate opt-ins.
Illustrative customer workflow
01 - What it does
Find what the detection needs.
A quiet rule can mean several things. Watch helps the team examine rule health and coverage; Broken Pipe brings data-feed evidence into the same maintenance workflow, so the next step follows the observed issue.
Distinguish silence from a broken feed.
Watch brings rule health and MITRE ATT&CK coverage together across connected technologies. Available analyst verdicts help identify noise, while Broken Pipe flags stopped ingestion or parser drift and can add an AI explanation grounded in the evidence. Silence calls for investigation rather than proving that the rule is broken. Your engineers can trace the data before changing detection logic.
Detection quality becomes a service you can show, with evidence per customer.
Harbor Retail: SplunkExample
- Rules
- 88
- Silent
- 5
- Noisy
- 3
- Broken feeds
- 1
Illustrative setup and values, not customer results.
Evidence from the feed
Inspect stopped ingestion and parser drift before proposing a change.
02 - How it works in the product
Inspect, design, then review.
Connect a supported technology with the access your workflow needs. Import its rules and harvest its schema, then work from observed health findings or a coverage gap to a reviewable change.
- 01Watch
Review rule health and MITRE ATT&CK coverage across connected technologies.
- 02Broken Pipe
Inspect the evidence behind stopped ingestion or parser drift.
- 03Design
Ask Optimus Architect for a detection grounded in available tables and fields.
- 04Library
Find community content, convert for the target and review the translation.
- 05Settings
Check technology opt-ins and permissions before applying eligible changes.
Autopilot applies eligible low-risk fixes only for opted-in technologies, allowed fix types and passed simulations. Library auto-deploy is a separate per-technology setting.
03 - How it connects
Connect maintenance to detection work.
Optimus has its own license and can operate separately from Cerebrum. When matched Cerebrum rule statistics are available, they add noisy-rule evidence; Detection Lake provides a separate workflow for local detections.
Works with
In the editions
The Portal, Autonomous SOC and SecOps PlatformLicensed on its own
Virtus Optimus requires its own license entitlement.
04 - What it means for your service
Make detection quality a service line.
Find noisy, silent and broken rules across the customer stacks you connect, with the evidence behind each finding. Stopped ingestion surfaces as a finding instead of a surprise, and each fix follows the review path or the opt-in automation you set per technology.
Reuse detection content
Start from community rules or existing coverage before authoring a detection.
Control the change
Review the simulation and the target’s supported operations before application.
Explain the maintenance work
Use rule and feed evidence to describe the issue your team investigated.
Start with one customer
- 01Connect one technology
Confirm the Optimus entitlement and required connector access.
- 02Import and inspect
Harvest the schema and review rule health and feed evidence.
- 03Review a proposal
Check simulation results and target behavior before applying a change.
Questions about Detection estate across customer stacks.
1Does Optimus come with The Portal or SecOps Platform?
Virtus Optimus is licensed on its own, outside the Autonomous SOC and SecOps Platform tiers. It requires its own license entitlement and the relevant permissions; a provider edition does not make Optimus part of its defaults.
2What do we need to start?
Connect a supported technology with the relevant access, import its rules and harvest its schema. AI authoring and explanations need a configured model provider. Test, create, update and rollback capabilities vary by target, so check the operations your workflow needs.
Have any other questions? Talk to our team
Find the detection issue.
Control the change.
Review a customer’s connected technology and detection maintenance workflow with the Imperum team.