How a design partnership works.
Kyrolan is in early access. Design partners run the agents on their own detection work, with us alongside, and shape what the product becomes.
Detection teams on Splunk with more work than people.
- You run Splunk and keep detections in a repository with merge requests.
- You have a backlog of techniques to cover, or live rules that are too noisy.
- One or two of your engineers can review agent output each week.
- MSSPs and in-house SOC teams are both a fit.
What you provide
- Read-only Splunk search access, scoped to the indexes you choose.
- Access to your detection repository so agents can open merge requests on their own branches.
- A lab for attack simulation, if you want simulation. It is optional.
- One or two named engineers who review and approve.
Week by week.
The first month is deliberately small: one technique and three noisy rules, so both sides can judge the output on real work.
Access and scope
- Set up read-only search and repository access.
- Pick one technique to cover.
- Pick three noisy rules to tune.
First proposals
- First merge request, reviewed by your engineer.
- First tuning proposal, with the exact alerts it would remove.
Validate
- Attack simulation in your lab, if you have one.
- Post-checks on approved tuning changes.
Review together
- Go through the results and evidence with your team.
- Decide next steps, or stop.
Artifacts your team can review and keep.
Threat brief
Cited procedures and test variants for the technique you chose.
Coverage report
Per procedure: data available normalized, available raw, or missing.
Merge requests
Detections and filter macros in your repository format, plus a runbook per detection.
Validation report
Which variants fired, false positives per day against your target, and a verdict.
Tuning diffs
For each noisy rule: clusters, the proposed change, the alerts that would disappear, and a rollback plan.
Audit trail
Every query, proposal and approval, exportable.
No lock-in.
You can stop the engagement at any time. Everything merged into your repository is yours, and we remove our access when you ask.
Agreed up front.
Design-partner pricing is scoped per engagement and agreed before work starts.