Fluency is the only SIEM that is fully compliant with Sigma, the open source standard in SIEM rules. Fluency can run all Sigma rules simultaneously without a performance hit. There is no conversion of rules, nor is there down selection. The rules analyze data as it enters the system, always creating real time alerts, meaning zero mean time to detection (MTTD). Fluency is even compatible to the proposed features of Sigma.

​

This means that your analysts benefit from the largest community of open source researchers for log analysis.

​

It doesn't stop with Sigma.

​

Fluency is the only pure real time SIEM. Fluency watches data as it is collected, while traditional SIEMs store data and then search a database to detect. Fluency maintains state and alerts immediately upon a match. Stateful detection allows for machine learning and historical correlation to improve the accuracy, therefore reducing noise and alert fatigue. 

A database query is a pitiful means of detection. Detection is a balancing act of matching knowledge to the event, while excluding matches that are wrong. Good security considers not just fields and values. Good security considers state, situational knowledge, environment, and history. There is more to quality detection than what can be placed in a database search.