Clarity in every signal.
To build a future where security teams can uncover hidden threats with clarity, confidence, and intelligence.
CYBERSECURITY · ARTIFICIAL INTELLIGENCE · THREAT INTELLIGENCE
Track Hidden Events.
Verify Online Risks.
See What Others Miss.
THEVOR Intelligence brings evidence-governed threat hunting into focus, transforming MITRE ATT&CK hypotheses into grounded Sigma detections, controlled SIEM searches, and analyst-reviewable findings.
✳ Cybersecurity Artificial Intelligence Threat Intelligence
THREAT HUNTING / MISSION CONTROL
ILLUSTRATIVE UIACTIVE WORKFLOW
Sandbox previewDetection pipeline
✓ATT&CK hypothesisBehavioral context grounded01
✓Detection eligibilityTelemetry compatibility gate02
Sigma validationDeterministic rule checksREVIEW
○Finding adjudicationAnalyst retains final verdict04
Source-aware · auditable · governedDEMO / NO LIVE SIEM
ATT&CK T1059.001
Provenance secured
697Validated hypotheses
505Grounded detection plans
540Baseline Sigma rules
404Recorded SIEM hunts
Research evaluation ↗
01 / OUR PURPOSE
See what others miss.
Purpose-built around trust, precise reasoning, actionable intelligence and clear decision-making.
From data to decisions.
We help security teams find hidden threats, turn data into meaningful insights, and make better security decisions.
OUR PRINCIPLES Trust Precision Intelligence Clarity
02 / THE CHALLENGE
Automation without evidence
is just guesswork.
Detection engineering is more than writing a query. The system needs to know which behaviors matter, which telemetry actually exists, and whether a match constitutes defensible evidence.
Read the architecture notes ↗01
Evidence first
Telemetry availability, environment context and provenance are evaluated before detection content is approved for generation.
Source & environment grounding02
Deterministic controls
Eligibility, schema, field compatibility, rule checks and pre-execution safety are governed outside the language model.
Eligibility & validation gates03
Analyst authority
Raw matches remain candidate evidence. Triage assists prioritization without silently declaring incidents or closing cases.
Human-reviewed outcomes03 / SYSTEM ARCHITECTURE
One traceable workflow.
Multiple safety boundaries.
Explore the main evidence-to-action stages of the implemented research platform. Select a stage for its responsibilities and evaluation boundary.
◎
Model generation, deterministic validators, runtime observations and analyst verdicts are separate evidence types. Passing one gate never implies confirmed compromise.
04 / HANDS-ON SANDBOX
Experience a threat hunt.
Without touching production.
PUBLIC SANDBOX
Walk through an illustrative PowerShell investigation using four deliberately synthetic events. No live SIEM, hosted LLM, or XGBoost model is called.
INTERACTIVE WALKTHROUGH
01 / 0601 — Behavioral hypothesis
05 / PLATFORM IN ACTION
The actual interface.
Not a stock mockup.
Authentic captures from the original platform showcase its hypothesis reasoning, Sigma workflows and analyst investigation surfaces.
01 / PLATFORM CAPTUREDetection & hypothesesAwaiting verified video frame
Hypothesis Intelligence CenterActual interface screenshot pending
02 / PLATFORM CAPTURERules & validationAwaiting verified video frame
Sigma rule & campaign workflowActual interface screenshot pending
03 / PLATFORM CAPTUREFindings & triageAwaiting verified video frame
Hunt findings & analyst reviewActual interface screenshot pending
Authentic captures only · No fabricated dashboard images · Video must be reviewed for credentials or personal data before publication
06 / EXPERIMENTAL EVIDENCE
Measured results.
Clearly stated limits.
These numbers refer to distinct research evaluations. A parser-accepted rule is not a confirmed detection, and a synthetic demo is not a live SIEM validation.
Evaluation limitations ↗FINE-TUNED QWEN3-8B
Frozen test · n = 286Validator-constrained Sigma output
223/286 adapted outputs passed the recorded no-blocking-pySigma-issues gate. This is not live incident-detection accuracy.
View LLM evaluation ↗SPLUNK BOTS V3
Runtime hunt outcomes
404executed hunts
381 zero / inconclusive22 raw candidates1 error
0 verified malicious findingsAfter independent review of the 22 candidate searches
XGBOOST TRIAGE
Generalization evaluation
Validation macro-F1.5654
Frozen test macro-F1.4523
Organization-held-out performance declines. The classifier supports analyst triage only, with an explicit heuristic fallback when fields are incompatible.
NOTE ON INTERPRETATION
Recorded offline metrics, SIEM execution studies and local integration tests are complementary, not an overall “autonomous threat detection accuracy.” See the repository and Phase 2 report for methodology and limitations.
07 / THE STACK
Built for inspectability.
Designed for extension.
A research-grade pipeline and a product-oriented interface, joined by explicit evidence contracts and source-aware execution boundaries.
FOUNDATIONS 01
MITRE ATT&CK + SigmaHQ
Behavioral knowledge and portable detection content.
MODEL GENERATION 02
Qwen3-8B + QLoRA
Task-specific model benchmark; separately configured inference service.
VALIDATION 03
Sigma / pySigma
Rule checking with separately governed execution controls.
TELEMETRY 04
Splunk SPL
Compiled searches, runtime recording, candidate evidence review.
TRIAGE 05
XGBoost
Frozen classifier with feature compatibility and honest fallback.
APPLICATION 06
FastAPI + React
Analyst-facing interface, services, persistence and reporting.
08 / CONTACT
Let's build clarity
around security.
For cybersecurity discussions, threat intelligence, AI collaboration and platform inquiries, connect with THEVOR Intelligence.
CONTACT THEVOR
Get in touch
thevor.intelligence@gmail.com
Send an email ↗Explore the technical implementation and documentation via GitHub ↗.
EXPLORE THEVOR
See the unseen.
Explore the intelligence.
Inspect the code, explore the safe interactive investigation, or open the protected platform when a deployment has been configured.