Detection baseline · Read-only
Some of your detections can’t fire. Dectyl shows which, with evidence your team can verify in their own environment and recheck after the fix.
Read-only · No raw events · We find what’s broken and verify the fix. You stay in control.
Every enabled rule in your agreed estate. A verdict with evidence. The report is yours.
Sample · Splunk structural assessment
A confirmed blocker prevents these rules from firing within the assessed scope.
Included in the 133 CANNOT FIRE total · Illustrative data
The full report, with supporting evidence and verification steps, is shared with the customer after the findings session.
Rules meeting structural prerequisites
759 / 1006
75.4% · zero credit for indeterminate or broken rules
1,006 enabled, deployed, in-scope rules. What counts as verification
Dectyl identifies confirmed blockers within the assessed scope and gives your team evidence to verify the finding. Your team makes the fix, then rechecks the result.
Your first report is free.
An estate is the SIEM environment and deployed rule inventory we agree to assess together.
Send your SIEM and estate. You keep the report.
Compare baselines and verify fixes with follow-up reports →