TIDE

Threat Informed Detection Engineering

A standalone, containerized platform for managing the full Detection Engineering lifecycle from threat intelligence to validated SIEM rules.

Architecture Overview

TIDE utilizes a robust, three-tier architecture designed for air-gapped or enterprise environments:

Nginx

Handles SSL termination and reverse proxying.

FastAPI

Powers the core REST API and HTMX dynamic frontend.

DuckDB

Embedded analytics database for high-performance rule caching.

Features

TIDE offers a range of features designed to streamline the Detection Engineering lifecycle:

Keycloak Integration

Seamless integration with Keycloak for authentication and authorization.

MITRE ATT&CK Integration

Integration with the MITRE ATT&CK framework for threat intelligence mapping. Built into the core of TIDE for airgapped environments.

OpenCTI Integration

Integration with the OpenCTI platform for threat intelligence management. Pull threat intelligence data directly into TIDE for analysis and threat correlation.

SIEM Integration

Pull threat detection rules directly into TIDE from your SIEM for centralized monitoring and response.

Rule Validation Workflow

Comprehensive workflow for validating detection rules, including manual analyst review. Includes promotion of rules based on **Quality** and **Metadata**.

SIGMA Integration

Integration with the SIGMA framework for rule management and background synchronization state. Built into the core of TIDE for airgapped environments.