← All modules
Marketplace
Field-tested detection content, ready to acquire and distribute among your customers.
What it does
- As of October 1, 2026: 23 detection rules spanning 6 data sources — Microsoft Entra ID, Fortinet, Google Cloud, GitLab, Microsoft 365, and OpenAI — every one mapped to its MITRE ATT&CK tactic and technique. The catalog keeps growing as new content ships, so these numbers are a snapshot, not a ceiling.
- Field-tested response playbooks, not simulated: Mandiant DTM Triage runs fully automatically, classifying alerts and enriching them against urlscan.io, Google Threat Intelligence, and Azure AD.
- The Suspicious ASN Playbook keeps a human in the loop — it pauses for an analyst's decision before escalating, using CrowdStrike Falcon and Google Threat Intelligence to build the case.
- A one-way Jira Service Management Operations integration, so a confirmed finding can open, note, or close a JSM alert — every write checked against JSM's own API before it's reported as successful.
- Acquire any rule, playbook, or integration with Marketplace tokens and deploy it straight through Content Hub — no separate build from scratch.
Who it helps, and when
A detection engineer who needs real coverage for a data source today, not a rule written from first principles next sprint — and an MSSP that would rather acquire field-tested content than reinvent it per customer.
Book a Demo
See Marketplace on your own customer fleet.
30 minutes, no slide deck required — we'll walk through the modules most relevant to how you run SecOps today.