How does the SuperClue SOC work?
You install the SuperClue agent on your servers. It collects process, network, log, file and package data and sends it to SuperClue, where detection rules raise alerts, incidents and breach records. Your team works them with playbooks, shifts and threat hunting.
Which systems does the agent support?
The agent (version 6.1.0) runs on Linux and Windows with full coverage, and on macOS with reduced coverage. It also runs as a Docker container or a Kubernetes DaemonSet.
| Collector | Linux | Windows | macOS |
|---|---|---|---|
| Processes, network, logs | Yes | Yes | Partial |
| File integrity monitoring | Yes | Yes | Partial (polled) |
| Package inventory and CVE matching | Yes | Yes | Partial |
| CIS L1 configuration checks | 20 checks | 14 checks | No |
| Rootkit checks | Yes | Partial | No |
| Active response | Yes | Yes | No |
| Signed self-update | Yes | Yes | Yes |
Agent binaries and manifests are Ed25519-signed.
What does it detect?
- 58 built-in host intrusion rules, all mapped to MITRE ATT&CK. You can add your own rules.
- 22 rootkit signatures plus checks for hidden processes, kernel modules and binary integrity (Linux).
- Vulnerable packages, looked up against OSV.dev.
- Cross-host correlation when the same activity hits 2 or more machines within 1 hour.
- Your own indicators of compromise (SHA-256 hashes, IPs and domains).
What happens when something is detected?
Critical events open an incident automatically. Incidents have a lifecycle, an assignee, an SLA and escalation. SuperClue also checks events against 8 breach patterns: credential dumps, PII exposure, mass data exfiltration, database compromise, ransomware indicators, unauthorised access, host compromise and financial data exposure.
On Linux and Windows, active response can block or unblock an IP, kill a process, disable or enable an account, isolate a host, restart a service or run a custom script.
How do playbooks and shifts work?
A playbook is a list of response steps for one type of incident. You run it by hand, or set it to start automatically on matching event types, and track each step as it is done.
Shifts define which analysts are on duty on which days and hours. SuperClue shows who is on duty, assigns new incidents to them and records handovers between shifts.
Can I hunt through raw data?
Yes. Threat hunting searches raw telemetry by kind (process, connection, DNS, log, exec, USB) with time and machine filters. Raw telemetry is kept for 30 days by default.
How long are SOC logs kept?
SOC logs are kept for one year (365 days) by default, twice the 180-day minimum in the CERT-In Directions. You can also stream events to your SIEM over syslog, CEF or Splunk HEC. See integrations and the SOC agent overview.
Install the agent on your first server.
Read the install guide