Brava

• Asking whether your SIEM would catch a ransomware attack on your AWS account, then getting each missed step fixed with a new detection that has been proven to fire
• Re-testing the detection library automatically after a log source migration, parser update or field rename to find rules that silently stopped working
• Giving a board or audit committee an ATT&CK coverage map and readiness score backed by replayed evidence instead of rule counts
• Investigating a question such as who accessed a sensitive S3 bucket after hours and whether data left the account, across SIEM, archive, identity and cloud audit logs
• Identifying log volume no detection reads and routing it to low-cost storage before a SIEM renewal
• Onboarding log sources that have no native connector into a SIEM such as CrowdStrike NG-SIEM through the data pipeline

Brava targets a problem most detection programs know they have but rarely measure: rules that silently stop firing after the environment changes. Synthesizing attack telemetry instead of detonating attacks is what makes continuous re-testing practical in production, and requiring the replayed evidence to produce a real alert before a gap counts as closed is the right standard. The tradeoff is that you are trusting Brava's model of what an attack leaves behind, and nothing here tests prevention, so it complements rather than replaces red teaming and breach-and-attack exercises. The investigation and pipeline modules make it a broader SecOps purchase than a pure validation tool, which helps the cost case but makes the evaluation larger. With no public documentation, ask in the demo where telemetry is processed, which SIEMs get native rule writing, which models run the agents, and how the cost savings were measured.

About Brava

Most detection programs write a rule, maybe test it once, and then trust it for years while log sources move, fields get renamed and parsers change underneath it. Brava is built around closing that loop continuously. You give it a goal, such as a ransomware attack on your AWS environment. Its agents model your environment and pick the techniques the attack would use, independent of your existing rules and threat libraries, then generate the exact telemetry each step would produce across your log sources, fingerprinted field by field, without executing the attack. Brava checks which steps your SIEM recognizes and why the rest go unseen, writes the missing detections in your SIEM's native query language using only fields the evidence shows exist, then replays the evidence and confirms a real alert appears in your real SIEM. The result is a MITRE ATT&CK map marked validated, partial, blind or no telemetry, a single readiness score, and a list of gaps that each name the log source that would close them; runs can be scheduled as automated game days and re-run after every environment change. The same evidence powers two more jobs. Aquarium, the investigation agent, takes a question in plain English, plans queries per source, searches the SIEM, archived logs, EDR and cloud audit trails in one pass, re-plans as results come in, and writes a report in which each finding cites the raw events behind it. The data pipeline parses, enriches and normalizes logs on the way in, sends the SIEM only the events detections actually read, and moves the rest to low-cost storage where it stays searchable by Aquarium and can be replayed. Brava says it works with more than 70 sources and destinations, including Splunk, Microsoft Sentinel, Elastic, CrowdStrike NG-SIEM, Google SecOps, Wiz, Snowflake and Amazon S3. It came out of stealth on November 4, 2026. The tradeoffs: there is no public documentation, pricing, self-serve trial or published deployment architecture; access starts with a demo built around your SIEM; synthesized telemetry tests whether detections would fire, not whether preventive controls such as EDR blocking would stop a live attack; and the 65 to 85 percent SIEM cost reduction it cites is the company's own customer figure.