Powered by ARGUS — Multi-tenant security intelligence engine
The threat intelligence platform for modern SecOps teams. ATT&CK-native, SIEM-agnostic, and built for analysts who need answers — not more dashboards.
Why INTERRO
Query any technique, threat group, or actor by ID or natural language. Get ATT&CK mitigations and D3FEND countermeasures in the same response. No context switching between tools.
Cyber threat susceptibility scoring scoped to your sector vertical. A merit-ranked remediation roadmap tells you exactly which controls to implement for maximum risk reduction.
Live event search, log fidelity validation, and detection rule auditing — against your Chronicle, Sentinel, Securonix, or Splunk environment. INTERRO adapts to you, not the other way around.
Platform Capabilities
Every feature is purpose-built for security operations — not adapted from a general-purpose analytics tool.
Query ATT&CK techniques, threat groups, and actors by ID or natural language. Get structured intelligence — tactics, procedures, associated CVEs, and D3FEND defenses — in seconds.
Run live queries against your connected SIEM environment. Supports UDM-native queries for Chronicle, SPL for Splunk, KQL for Sentinel, and natural language across all platforms.
Score your environment's exposure against ATT&CK using your sector vertical as context. Get a cyber threat susceptibility score, a merit-ranked remediation roadmap, and drift detection over time.
Map your active detection rules directly against the ATT&CK framework. Know exactly which techniques you can detect — and which have no coverage at all.
Generate full sector-specific threat reports in seconds. Covers the top threat actors targeting your vertical, their TTPs, detection coverage gaps, and recommended countermeasures.
Build sequential investigation workflows without writing code. Chain queries and intelligence lookups, pass outputs between steps using template variables, and execute entire investigations in one run.
Feed threat intelligence PDFs, advisories, and incident reports directly into INTERRO. Automatically extract TTPs, CVEs, threat actors, and timelines — mapped to ATT&CK and added to your tenant library.
Construct fully-cited investigation reports with source attribution, confidence weights, and timestamps. Export structured evidence chains for incident response, legal handoff, or executive briefing.
Visualize relationships between threat actors, techniques, infrastructure, and your environment as an interactive graph. Drill into nodes, expand connections, and export for reporting.
SIEM Compatibility
INTERRO connects to your existing SIEM. You keep your data. We bring the intelligence layer on top.
Google SecOps SIEM — UDM-native, cloud-scale detection and event search.
Available NowAzure-native SIEM and SOAR with Microsoft 365 and Defender integration.
Adapter ReadyCloud-native SIEM + SOAR with UEBA and insider threat capabilities.
Adapter ReadyMarket-leading SIEM with SPL query language and extensive ecosystem.
Adapter ReadyDon't see your SIEM? Contact sales — we add integrations on request.
How It Works
Enter your SIEM credentials through the secure onboarding wizard. Credentials are encrypted at rest in Vault — never stored in plaintext. Connection is tested and confirmed before you proceed.
Tell INTERRO what industry you operate in. This scopes your threat profile to the actors and TTPs known to target your sector — so coverage gaps and posture scoring are always relevant to your real threat landscape.
Search your SIEM, look up TTPs, run posture assessments, generate threat reports, and build investigation workflows. A consistent, repeatable intelligence process — from a single platform.
Pricing
No long-term contracts. No setup fees. Start with a free demo key — no credit card required.
Core SIEM search and threat intelligence for day-to-day SOC operations.
Full ATT&CK + D3FEND, posture intelligence, threat reports, and unlimited projects.
Unlimited seats, white-label deployment, SLA, dedicated support engineer.
MSSP & Multi-Tenant Licensing
INTERRO is built for MSSPs. Every client gets a fully isolated tenant with their own SIEM environment, threat profile, detection rules, and investigation projects — all managed from a single operator console. ARGUS handles tenant routing, credential isolation, and audit separation automatically.
Starting at $5,000/month for up to 10 tenants. Volume pricing available for 20+ tenants. Talk to sales →
Security & Compliance
SIEM credentials are encrypted at rest in HashiCorp Vault, protected by hardware key (YubiKey 5 NFC). Never stored in plaintext.
Every tenant operates in a fully isolated context. Credentials, SIEM access, projects, and data are scoped strictly to the tenant — no cross-tenant access is architecturally possible.
API keys can be rotated on demand from the account page. Rotation is immediate — old keys are invalidated the moment a new key is issued.
All API actions are logged per tenant. Enterprise customers receive structured audit logs for compliance review and incident reconstruction.
Platform architecture and posture scoring methodology align to the NIST Cybersecurity Framework. SOC 2 Type II audit in progress.
INTERRO does not store your SIEM event data. Queries execute live against your environment. We store only your configuration and project definitions.
Common Questions
No. Chronicle is the first available SIEM adapter, but INTERRO is SIEM-agnostic. Microsoft Sentinel, Securonix, and Splunk adapters are in active development. All threat intelligence features (ATT&CK, D3FEND, VTM, threat reports) work independently with no SIEM required.
ARGUS is the multi-tenant security intelligence engine that powers INTERRO. It handles SIEM adapter routing, ATT&CK and D3FEND intelligence, posture scoring, and tenant isolation. INTERRO is the commercial interface layer on top of ARGUS.
Yes. Generate a free demo key from the dashboard — no credit card required. The demo tier includes ATT&CK technique lookup, basic TI search, and fidelity check with no time limit.
A vertical profile maps your industry (legal, healthcare, financial services, etc.) to a curated set of high-confidence ATT&CK TTPs used by threat actors known to target that sector. It scopes your posture assessment, coverage analysis, and threat reports to what's actually relevant to your environment.
Credentials are encrypted at rest using HashiCorp Vault with hardware key protection (YubiKey 5 NFC). They are isolated per tenant and never logged, shared, or accessible outside your tenant context. You can delete your credentials at any time from the account page.
Yes. All INTERRO capabilities are available via REST API using your X-INTERRO-Key header. Full API documentation is available at app.interroai.com/api/docs. Enterprise customers can use the API for SIEM and SOAR integrations.