Tippel.ai
Product · Microsoft Sentinel

Sentinel detections that provably hold.

This system generates detection rules for Microsoft Sentinel and proves with Microsoft’s own parser that they hold. 185 tests cover the validation logic — and everything runs offline inside your network.

Request a demo DORA datasheet for financial institutions
The problem

The expensive problem isn’t generation — it’s trust

Generation became a commodity

Microsoft’s own Security Copilot writes detection queries (KQL) — bundled into licences many companies already pay for. The value no longer sits in writing the rule.

A wrong rule stays silent

A plausible-looking detection that is subtly wrong fires on noise — or misses the attack silently. It looks clean in review. Only in a real incident do you learn it never worked.

Roughly 13% are broken

That share of detection rules never fires — measured by CardinalOps across more than 13,000 rules from hundreds of production SIEM environments, Sentinel included. It is a validation problem, not a writing problem.

The validation

A parser doesn’t guess — it binds, or it names the failure

Every generated query is bound deterministically against Microsoft’s own KQL parser — the same library Sentinel itself builds on. Every table and every field resolves against your real schema, not against an assumption. Tools that instead have a second AI “look over” the result inherit exactly the uncertainty they claim to fix: a guess grading a guess.

One run, end to end data the tool repairs itself you send it back in Use case REQUIRED Schema OPTIONAL Reference catalogue IF NO SCHEMA Event mapping SIGNED OFF House rules IN THE SYSTEM PROMPT Prompt one message, four parts 1 the schema — and how far to trust it 2 the binding event IDs 3 one finished query as a style example 4 the requirement itself Language model cloud or local (vLLM) KQL one draft ALL FOUR SEE THE SAME QUERY Microsoft’s parser syntax · columns · function arguments House rules hygiene · the zero-result traps Event coverage are the mapped IDs there? Second opinion requirement vs. query ONLY IF ALL PASS detection.kql best attempt Report findings · exit code Repair — findings go back into the model Improve — your correction re-enters the same machinery, nothing skipped

The “unverified” flag

The report records what could not be checked against your schema — instead of hiding it. A flagged “unverified” carries more weight than a green tick with no check behind it.

Trap 1: structurally empty

A rule whose own logic can never return a row. It parses cleanly, runs without errors — and fires in no case whatsoever. Binding catches this before the rule goes live.

Trap 2: missing field

A rule references a table or field that doesn’t exist in your workspace. It looks clean in review and returns nothing on real data. Schema binding exposes exactly this gap.

Evidence from development: In a test run, a generated rule passed the parser, the column check and every house rule — and would have reported zero incidents forever, because it compared a time difference in ticks rather than seconds. Told about the defect, the model fixed the unit — and reversed the arguments of the difference, leaving the rule dead again. Both traps have been caught by a deterministic check ever since: a model repairs what you point at, and quietly breaks something next to it.
Delivery model

Runs offline — hence a licence, not SaaS

The validation needs nothing but the rule and the schema: no network access, no workspace connection, no outbound connection to any cloud. Generation, too, can stay in-house — the system demonstrably runs against a locally hosted model (vLLM); switching takes two environment variables. Your detections and your logic never leave your network. A regulated SOC doesn’t buy a black box that ships its rules to someone else’s cloud — it licenses something that runs inside its own perimeter. Why exactly this delivery model spares you the DORA third-party obligations, per BaFin’s position, is covered in the DORA datasheet.

The honest limit

Binding proves a rule can technically hold — not that its logic hunts the right threat. For that there is an optional LLM second opinion: deliberately a different model, queried in a structured way and advisory only — whether a rule holds is decided by the deterministic checks and by a human with a threat model. Overpromising would be exactly the kind of plausible-sounding false statement this system is built against.

Licence and price

You briefly describe your Sentinel environment, I demo the system on your context for 30 minutes — then you receive a written licence offer. First built for Bluerope Consult GmbH, where query development shrank from days to minutes.

Data egress is measured, not asserted: a complete run against a cloud service consists of two HTTP calls totalling roughly 29 kilobytes — requirement text and column names, no log data, no IP addresses, no event timestamps, no workspace connection. The measurement can be repeated on-site at the client.

Detections your audit believes

You talk to the engineer who built the system. A short description of your Sentinel environment is enough for a concrete conversation — info@tippel.ai.

Request a demo