Overview
Patronus SIEM uses a risk-based scoring model instead of traditional alert-per-event detection. Here's how it works:
1. Detection Rules Generate Risk
Each detection rule in your Splunk environment assigns a risk score to entities (users, hosts, IPs) when a condition matches. For example, a brute-force detection rule might assign 20 points of risk to the target user.
2. Risk Accumulates on Entities
As multiple detection rules fire against the same entity within a time window, the risk score accumulates. A user who triggers three different detection rules might have a combined score of 60.
3. Threshold Triggers Incident
When an entity's cumulative risk score exceeds the configured threshold (default: 100), an incident is automatically generated. This incident contains all the contributing detection events, providing a complete timeline.
4. Why This Is Better
Traditional SIEM approaches create one alert per event, leading to alert fatigue. The risk-based approach means:
- Fewer, higher-confidence incidents — instead of hundreds of individual alerts.
- Context built in — every incident comes with a timeline of contributing events.
- Natural prioritization — the highest-risk entities surface first.
- Less time on false positives — individual low-signal events don't create incidents on their own.