A log source changes, a field goes empty, a noisy rule gets switched off at 3 a.m. and forgotten. Pulse keeps a heartbeat on every rule in every customer SIEM: it fires real attacks at them, proves they still see data, calms the noise without muting the threat, and shows its work.
Take stock, look for noise, decide, report. The hand is the real minute. Deeper checks (data drift nightly, real attacks four times a day) run on a slower rhythm.
Straight from the fleet's own record. Every line is a real event on the lab SIEM; every rule name opens its receipt.
Each number is read from the lab fleet a moment ago.
Drift, noise, attack tests and lint only report. A single governor changes a rule, under a mass-change floor and a stop switch.
A noisy rule drops to silent monitoring, keeps watching, and is re-armed when it's quiet. It is never muted while an attack might be under way.
Who, when, why, and the evidence behind it, kept forever. Open any rule on the live Pulse to read its receipt.