01
Relationship-aware rules
Graph predicates catch what single events cannot: first-time relationships, fan-out, geo-hops, sequences, absences, new entities and sudden changes in connectivity.
Detection
Detection logic you can read, test and map.
kymeer ships graph-native detection rules mapped to MITRE ATT&CK, a rule engine that handles sequences and correlation, and a live coverage map that shows where you are blind.
124 graph-native detection rules, mapped to ATT&CK
How it works
Rules you can read before you trust them.
- 124 rules across 14 categories, mapped to 58 ATT&CK technique and sub-technique IDs — credential access, cloud and SaaS, defence evasion, ransomware and more.
- MITRE ATT&CK Enterprise v16.1 bundled; technique IDs are validated when a rule is saved.
- Live coverage view with export to ATT&CK Navigator.
- Conditions, Sigma-style matcher trees, correlation, thresholds, sequences, aggregations and YARA in one engine.
02
Transparent by default
Every rule shows its logic, its ATT&CK mapping and the indicators behind it, so analysts can judge a detection instead of trusting it.
Specifications
| Bundled rules | 124 graph rules in 14 categories |
|---|---|
| ATT&CK | Enterprise v16.1 · 58 technique and sub-technique IDs in bundled rules · Navigator export |
| Engine | Conditions, matcher trees, correlation, thresholds, sequences, aggregations, YARA |
| Sigma | Sigma-style matcher trees in the engine. kymeer does not bundle a Sigma library. |
| AI-drafted rules | Backtested; stay inactive until a person approves them |