Ninja Labz film · 2026-09-25 · live production data

Rule Forge: detections from our own threat intel, fitted to our own estate

Rule Forge reads two states: what we are (what we collect, what we already detect, who is attacking us) and what the world is doing (our own threat intel: ATT&CK techniques weighted by real actor use, fresh IOC families, CISA KEV). It proposes the rules in the gap, proves each one is not already covered, that it catches real attacks and that it stays quiet, then a human adopts it with one click.

  • 18 detection gaps found between our estate and our own threat intel
  • Every gap tested against all 25 live rules, not guessed
  • RedTail CVE-2022-22947 (CISA KEV, EPSS 0.98) caught on real traffic, adopted live
  • Nothing ships without self-test, backtest and a human click

More from the lab