Imperum
Autonomous SOC
Company
News

Virtus Optimus Detection Engineering & SIEM Optimization

Virtus Optimus finds the detection rules that stopped working.

Imperum’s Detection-as-Code module watches every rule across every SIEM you run, grades each one on your analysts’ own verdicts, and drafts the fix for you to approve. Built for teams running Splunk, Sentinel, QRadar, or Elastic, and for MSSPs running several at once.

Every SIEM you run Graded on analyst verdicts Approval by default
VIRTUSOPTIMUSSCANNINGElastic SecurityAWAITING SCANRULES WATCHED · LIVEQUEUEDMONITOREDMicrosoft SentinelAWAITING SCANSCHEMA DRIFT DETECTEDQUEUEDDEGRADEDIBM QRadar SIEMAWAITING SCANRULES WATCHED · GRADINGQUEUEDMONITOREDSplunk EnterpriseAWAITING SCAN11 of 2711 healthyQUEUED2700SILENTOpenText ArcSightAWAITING SCANSILENT RULES DETECTEDQUEUEDSILENT RULESImperumAWAITING SCANALL RULES VERIFIEDQUEUEDHEALTHY
2,700
Splunk rules in the estate above that haven’t fired in months. The dashboard stayed green the whole time.

Most SIEMs accumulate detection rules faster than anyone can maintain them.

Somebody writes the rules on installation day, and then nobody touches them again. Over the years they rot: some alert constantly about nothing, and some go completely silent because the data feeding them broke. The silent ones are the catch. They are switched on, they look healthy, and they are the rules that fail you during a real incident. Almost nobody measures them.

6
Connected technologies in the demo estate
6.5K
Detection rules watched across the estate
6
Live sources feeding it

One module, six surfaces.

Optimus is a single page of the Imperum platform with six tabs. Learn these six and you understand the product.

Overview

The whole estate in one place: live sources, rule counts per SIEM, and the fix pipeline from auto-fixed to rolled back.

Watch

Every rule graded on analyst verdicts: its false-positive rate, whether it went silent, and which MITRE techniques are uncovered.

Broken Pipe

Finds where data stopped arriving or a parser drifted, explains the cause in plain English, and proposes a fix you can simulate first.

Design

Architect writes new, tested rules from a plain-English description. Migrate converts one SIEM’s rules to another.

Library

14,208 ready-made rules from eight community sources, searchable and matched against the gaps in your estate.

Settings

Which systems are connected, how often everything re-checks, and the autopilot switches. You decide how much runs unattended.

Graded on what your analysts really did.

The false-positive rate is not a vendor guess. Optimus computes it from how your own team closed the alerts each rule produced, and it shows its working next to the grade.

90% FP · 20 reviews
One rule’s verdict in the demo estate: ninety percent false positive across twenty recorded analyst reviews. The sample size is always on the record.
85% · 141 of 166
MITRE ATT&CK coverage in the same estate, with every uncovered technique listed by name instead of hidden in a percentage.
Suspicious Encoded PowerShell ExecutionMAPPEDT1059.001ANALYST VERDICTSFALSE POSITIVETRUE POSITIVEEACH DOT IS ONE CLOSED ALERT90%FP· 20 REVIEWSMITRE ATT&CK COVERAGE85%141 of 166 techniquesNOT COVERED · LISTED BY NAME

From quiet rule to reviewed fix.

When a rule stops matching, the reason is usually upstream: a parser drifted, a field changed shape, a log source went dark. Optimus shows you exactly where, then does the engineering work that leads up to your decision.

01
Detect
A rule goes quiet or noisy. Optimus catches it on a fifteen-minute cycle.
02
Explain
It draws the pipeline from log source to rule and marks the fields that stopped resolving.
03
Draft
Virtus AI drafts the repair and puts the exact diff on screen.
04
Simulate
The fix runs against your real data before it can go anywhere.
05
Approve
A person says yes. Only then is anything applied, and it rolls back if verification fails.
05 APPROVESOURCESTREAMSTOREPARSERRULERegistry.actionRegistry.destRegistry.process_guidThe parser stopped resolving three fields this rule depends on.PROPOSED FIX+++BEFORE ANYTHING IS APPLIEDSIMULATEAPPROVEAPPLYUNLOCKED

The pattern: a parser drifts and registry fields stop resolving, which takes out a whole group of rules at once. Root cause in plain English, the diff on screen, nothing applied until it passes simulation and someone approves it.

A library that knows what you’re missing.

The Library is not just a catalogue. It compares 14,208 community rules against your estate and lists the MITRE techniques nothing you run detects, each matched to the rules that would cover it. Any of them converts to the language your SIEM actually speaks: Sigma to SPL, KQL, or AQL, one rule at a time or in bulk.

14,208
Ready-made detection rules
8
Community sources, every rule pinned to a version
25
MITRE techniques the demo estate misses, each matched to covering rules
15
National advisory sources monitored
04 TRANSLATEHAYABUSA4,322SIGMA3,302WAZUH3,058SENTINEL2,358ELASTIC792SLIMKQL320SECVYN31SECVYN2514,208detection rules indexed8 community sourcesevery rule pinned to a versioncompareyour estate · what it already detects25techniques nothing you run detectsone rule, the language your SIEM speaksSIGMASPLKQLAQL

Advisory published Tuesday, hunting Tuesday.

When an agency like CISA publishes an advisory, Cognitio turns it into a ready-to-hunt detection profile, usually the same day: it maps the techniques, finds matching library rules, translates them into your SIEM’s language, and runs them backwards over your history to answer the question that matters most: did this already happen to us?

Write new rules by describing them. Move old ones without a rewrite project.

Architect

Ask for a detection in plain English. Architect already knows your estate, so it checks the Library first: you might already own a rule that covers it. Then it writes the query against your harvested schema, real field names from your real SIEM, and runs the tests. You review the result before anything deploys.

Find PowerShell that's been encodedto hide what it's running.DESCRIBELINEAGERULETESTSuspicious Encoded PowerShell Executionindex=windows sourcetype=WinEventLog:Security| where match(process_name, "powershell")| rex field=command_line "-enc\s+(?<blob>\S+)"| stats count by host, user, command_lineTest Results: PassedAWAITING REVIEW

Migrate

Moving between SIEMs usually means a manual rewrite project. Migrate mapped 98 QRadar rules to Splunk in one run, validated each one, and reported which needed attention. Every translation is graded honestly, and “unsupported” is an answer you will actually see: it says “I can’t do this” rather than handing over a query that looks right and silently matches nothing.

ExactPartialBest-effortUnsupported
98 RULESIBM QRadar SIEMSplunk EnterpriseEXACTEXACTPARTIALEXACTEXACTBEST-EFFORTEXACTEXACTPARTIALEXACTEXACTBEST-EFFORTEXACTUNSUPPORTEDNO EQUIVALENT IN TARGET

How much runs unattended is your setting.

You keep the authority. Optimus does the engineering work that leads up to the decision.

Writing into your SIEM
Every change waits for a person to approve it. This is the default.
Approval required
Autopilot
If you switch it on, it only applies low-risk fixes that have passed simulation.
Optional
Failed verification
Any applied fix that fails its follow-up check is rolled back.
Automatic rollback

Frequently asked questions.

Optimus works across every SIEM you run: Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security, and more, all at the same time. Capabilities differ by platform. Some SIEMs can receive new rules, some can be searched back in time, and Optimus is explicit about which is which instead of pretending otherwise.
No. Anything that writes into your SIEM waits for a person to approve it. Autopilot, if you enable it, only applies low-risk fixes that pass simulation first, and any fix that fails verification afterwards is rolled back automatically.
From your own analysts. Optimus computes it from how your team actually closed the alerts a rule produced, and it shows the sample size next to the grade, like 90% FP across 20 reviews, rather than a bare percentage.
Optimus is a module in the Virtus family and is licensed separately from the platform tiers. Request a demo and we’ll walk through what it finds in your estate.
Yes, through an offline bundle. Air-gapped networks are common in defence and critical infrastructure, and Optimus is built to be delivered there.

The detection estate you already paid for, brought back into service and kept there.

Connect your SIEM, and we do the rest. Book a demo and we’ll show you what Optimus finds in your estate.