Four backends. One console. No pretending.
SOCPilots does not have a favourite SIEM and does not ask you to migrate to one. It connects to what you run, asks that backend what it is capable of, and builds the console around the answer.
The console adapts to the backend
Two customers on two different SIEMs do not get the same buttons. If a backend cannot author detection rules, the rule editor is not there to be clicked and disappoint someone. If it cannot contain an endpoint, containment is not offered.
This sounds like a small thing. It is the difference between a platform that works across SIEMs and a platform that works properly on one and badly on the rest.
- search_alertsavailableok
- author_rulesavailableok
- discover_log_sourcesavailableok
- isolate_endpointnot supportedhidden
What each backend supports
Capability depends on what the backend itself exposes. Where something is missing it is because that platform does not offer it, not because we have not got to it.
| Capability | Wazuh | Elastic | Splunk | QRadar |
|---|---|---|---|---|
| Alert ingestion and searchPull detections from the backend and search them from one console | yes | yes | yes | yes |
| ATT&CK technique mappingMap detections onto tactics and techniques for coverage reporting | yes | yes | yes | yes |
| Case creation from alertsDeduplicate, score and open cases automatically | yes | yes | yes | yes |
| Detection rule authoringWrite and deploy detection content from inside SOCPilots | yes | yes | yes | — |
| Agent and endpoint inventoryList the endpoints reporting in, and find the ones that are not | yes | partial | — | — |
| Log source discoveryWork out which sources are feeding the backend, and notice when one goes quiet | yes | yes | yes | partial |
| Endpoint containmentIsolate a host or kill a process from the case, under approval | — | yes | — | — |
Containment is manual and approval-gated wherever it is available — see safety gates. Network and identity actions such as blocking an address or disabling an account are not SIEM capabilities at all; they run through connectors to the platform that actually owns the control.
Two rules we do not bend
A workspace has exactly one backend
An organisation connects one SIEM, not a stack of them. That single rule is what makes routing, coverage and containment answerable rather than ambiguous — there is never a question about which system an action was meant for, or which one a number came from.
An unsupported action fails, loudly
Ask for something the backend cannot do and the request is refused with a reason. It is never quietly retried somewhere else, never run against a different customer’s integration, and never reported as done when it was not.
Running something else?
Backends are added as adapters against a common capability interface. Tell us what you run and we will tell you honestly whether it fits and what it would take.