Virtus Optimus Detection Engineering & SIEM Optimization
Virtus Optimus finds the detection rules that stopped working.
Imperum’s Detection-as-Code module watches every rule across every SIEM you run, grades each one on your analysts’ own verdicts, and drafts the fix for you to approve. Built for teams running Splunk, Sentinel, QRadar, or Elastic, and for MSSPs running several at once.
Most SIEMs accumulate detection rules faster than anyone can maintain them.
Somebody writes the rules on installation day, and then nobody touches them again. Over the years they rot: some alert constantly about nothing, and some go completely silent because the data feeding them broke. The silent ones are the catch. They are switched on, they look healthy, and they are the rules that fail you during a real incident. Almost nobody measures them.
One module, six surfaces.
Optimus is a single page of the Imperum platform with six tabs. Learn these six and you understand the product.
Overview
The whole estate in one place: live sources, rule counts per SIEM, and the fix pipeline from auto-fixed to rolled back.
Watch
Every rule graded on analyst verdicts: its false-positive rate, whether it went silent, and which MITRE techniques are uncovered.
Broken Pipe
Finds where data stopped arriving or a parser drifted, explains the cause in plain English, and proposes a fix you can simulate first.
Design
Architect writes new, tested rules from a plain-English description. Migrate converts one SIEM’s rules to another.
Library
14,208 ready-made rules from eight community sources, searchable and matched against the gaps in your estate.
Settings
Which systems are connected, how often everything re-checks, and the autopilot switches. You decide how much runs unattended.
Graded on what your analysts really did.
The false-positive rate is not a vendor guess. Optimus computes it from how your own team closed the alerts each rule produced, and it shows its working next to the grade.
From quiet rule to reviewed fix.
When a rule stops matching, the reason is usually upstream: a parser drifted, a field changed shape, a log source went dark. Optimus shows you exactly where, then does the engineering work that leads up to your decision.
The pattern: a parser drifts and registry fields stop resolving, which takes out a whole group of rules at once. Root cause in plain English, the diff on screen, nothing applied until it passes simulation and someone approves it.
A library that knows what you’re missing.
The Library is not just a catalogue. It compares 14,208 community rules against your estate and lists the MITRE techniques nothing you run detects, each matched to the rules that would cover it. Any of them converts to the language your SIEM actually speaks: Sigma to SPL, KQL, or AQL, one rule at a time or in bulk.
Advisory published Tuesday, hunting Tuesday.
When an agency like CISA publishes an advisory, Cognitio turns it into a ready-to-hunt detection profile, usually the same day: it maps the techniques, finds matching library rules, translates them into your SIEM’s language, and runs them backwards over your history to answer the question that matters most: did this already happen to us?
Write new rules by describing them. Move old ones without a rewrite project.
Architect
Ask for a detection in plain English. Architect already knows your estate, so it checks the Library first: you might already own a rule that covers it. Then it writes the query against your harvested schema, real field names from your real SIEM, and runs the tests. You review the result before anything deploys.
Migrate
Moving between SIEMs usually means a manual rewrite project. Migrate mapped 98 QRadar rules to Splunk in one run, validated each one, and reported which needed attention. Every translation is graded honestly, and “unsupported” is an answer you will actually see: it says “I can’t do this” rather than handing over a query that looks right and silently matches nothing.
How much runs unattended is your setting.
You keep the authority. Optimus does the engineering work that leads up to the decision.
Frequently asked questions.
The detection estate you already paid for, brought back into service and kept there.
Connect your SIEM, and we do the rest. Book a demo and we’ll show you what Optimus finds in your estate.