Detections
Test any detection against 30 days of logs
Run a rule against the last 30 days before you save it and see exactly what it would have caught.
The rule editor now has a Run against 30 days button. It scans the sources the rule reads and lists every match with the outcome, so you can tighten a rule before it ever pages anyone.
Most runs finish in under 30 seconds. Results are kept on the rule history.
Send us one week of logs. We send back what we found.
Connect one source with a read-only key. Within 48 hours you get a written report of what Wardell would have caught. No contract, and you can disconnect at any time.