Overview
BlackShield provides a unified detection ruleset engine that automatically evaluates incoming SIEM telemetry logs, scanner findings, and external attack surface exposures (EASM). All rules are stored and managed in native JSON format, providing zero-friction security evaluation out of the box.
Core Tenets & Architecture
Zero Configuration (No-Op)
Detection rules are active out of the box upon tenant onboarding. No manual rule enabling or configuration is required.
Immutable Platform Rules
System rules are completely visible to tenants in read-only mode, guaranteeing baseline compliance integrity.
Tenant Custom Rule Linking
Tenants can create custom detection rules and link them to parent rules via parent_rule_id.
Dual Telemetry & Findings Engine
Supports log, finding, or both target types.
Testing & Dry-Run Sandbox
Use the in-app Sandbox Tester or the SDK to simulate detection evaluation before deploying custom rules:
from blackshield import BlackShield
client = BlackShield(api_key="bsk_live_...")
test_res = client.rules.test(
rule_id="BS-LOG-AUTH-01",
target_type="log",
payload={
"source_type": "sshd",
"event_type": "ssh_failed_login",
"actor_user": "root",
"src_ip": "198.51.100.42"
}
)
print("Matched:", test_res["matched"])