Detect the attack, not the file name.
Varpulis runs your correlation rules on the event stream you already forward — Kafka, NATS, a webhook — outside the SIEM. It matches sequences across hosts, in the time the logs happened, and keeps its state through a crash.
Open source. Written for detection engineers who are tired of rewriting the same rules for every SIEM they are moved to.
The attacker renamed PsExec to svcupdate.exe. A rule that matches the file name sees nothing. A rule that matches what the tool does catches it, across two machines, ten seconds apart. These are the events of the demo below, not an illustration.
Your rules are the asset. The SIEM underneath them keeps changing.
SIEMs are being sold, merged and retired. IBM's QRadar SaaS reached end of life in April 2026 and its customers are being moved to Palo Alto's Cortex XSIAM. LogRhythm is now part of Exabeam. Each move asks the same question: what happens to the correlation rules your team spent years tuning?
Rules written for Varpulis read the stream your SIEM already forwards, so they move with you. The SIEM keeps storing and searching logs; the correlation stops being locked inside it.
Sources: Techzine on QRadar customers moving to Palo Alto, Blumira on the April 2026 QRadar SaaS end of life, the Exabeam and LogRhythm merger.
What the engine does for a detection team
Sequences, not single events
A rule says what happened in order: this, then that, on the same host or across hosts, within a window. Negation, repetition, aggregates and joins are part of the language, so a kill chain is one rule rather than a chain of saved searches.
Log time, not arrival time
.within(2m) means two minutes between the timestamps in the logs, whatever order and delay they arrive with. A replay a week later raises the same alerts. A burst of late events cannot fake a match.
A crash does not lose a half-matched attack
Each rule saves its open sequences together with the position in the stream they stand for, and resumes from there after a restart. In the demo the process is killed with kill -9 between the two halves of an attack, and the alert still arrives.
Alerts are published before the input is acknowledged. After a crash an alert can be raised twice; it is never lost.
It reads what you already forward
Kafka, with offsets committed only after the alert is out. NATS JetStream. MQTT, AMQP and IBM MQ. An HTTP webhook for anything that can post. Your SIEM keeps its role; Varpulis needs a copy of the stream, not a migration.
Your Sigma rules come with you
sigma convert -t varpulis turns Sigma rules into VPL, correlation rules included: a temporal_ordered correlation becomes a sequence matched as the events arrive, rather than a query over what was stored.
We ran every Windows rule of the SigmaHQ repository that converts, 2 398 of 2 410, as one program over the 196 081 events of MITRE's APT29 evaluation. It raises 2 824 alerts from 81 rules, on exactly the events an independent Sigma engine flags, in 23 seconds on one laptop core. How it was checked, and how to run it yourself.
Small enough to put next to anything
One 8 MB binary and about 10 MB of memory per rule set, no JVM. A correlation rule handles up to about 25 000 events per second on an ordinary eight-core machine, and the sizing is published: what costs is the number of attacks half-seen at once, not the number of events.
Open, down to the last rule
The engine, the runtime it ships on, the demo and the example rules mapped to MITRE ATT&CK are Apache-2.0 on GitHub. Read how it decides before you trust what it decides.
The rule that caught it
stream SmbServicePipe = Network .where(DestinationPort == 445) stream RemoteServiceExec = Process .where(ParentImage.ends_with("\services.exe")) stream LateralMovement = SmbServicePipe as smb -> RemoteServiceExec as exec .within(2m) .emit( rule: "lateral_movement_smb", mitre: "T1021.002", source_host: smb.Hostname, target_ip: smb.DestinationIp, remote_process: exec.Image )
Two filters and a sequence. The file name never appears, which is why renaming the binary changes nothing.
Written as a scheduled search, the same logic becomes a query joining two indexes over a time bucket, and a pair that straddles two buckets is missed. Here the window is part of the match.
The full rule, with its event declarations is 57 lines, most of them the Sysmon fields it reads.
See it in forty seconds
The demo runs two rules side by side on one bus: the signature above, and the behavioural sequence. It checks four things and says which held. This is a recording of one run, at real speed with a two-second pause between steps.
Press play to watch the run. To run it yourself:
# needs nats-server and the nats CLI on the machine git clone https://github.com/cpoder/vejas && cd vejas cargo build --release --manifest-path core/Cargo.toml e2e/detect-demo/run.sh # PAUSE=manual walks it step by step
Both rules fire on PsExec under its own name. The signature goes quiet when the binary is renamed, and the sequence still fires. Then the runtime is killed mid-sequence, restarted, and the alert arrives anyway. The same checks run on every commit.
Working with us
Open source
Free
The engine, the runtime, the demo and the example rules. Run it yourself, read it, change it. Questions go to the GitHub issues.
Rule set port
€4 900fixed price excl. VAT, two weeks
Up to 25 of your correlation rules, from QRadar, LogRhythm, ACE, Splunk or Sigma, ported twice: to Sigma, which any SIEM with a Sigma backend can run, and to Varpulis, which runs them on your event stream. Each rule is tested on your own sample events.
You get the rules, their tests, and for each rule what it catches, or why it could not be ported. Useful for a SIEM migration whether or not you run Varpulis afterwards. Invoiced on delivery.
Detection proof of concept
€10 000fixed price excl. VAT, four weeks
We take three to five of your detection scenarios from your current SIEM to running Varpulis rules on your own event stream.
- Audit your current rules against MITRE ATT&CK and choose the scenarios with you.
- Deploy next to your SIEM, connect one source, first scenario running.
- The remaining scenarios on real traffic, each with a runbook.
- Handover, training, and a written report with a recommendation to continue or stop.
You keep the rules and the deployment. Half on signature, half on handover.
Support and detection library
From €25 000per year, excl. VAT
Your deployment, self-hosted with a support agreement or run for you on a dedicated instance, and a curated library of rules kept current against ATT&CK.
Not ready for a project? Send three rules.
From ACE, QRadar, Splunk or Sigma, with one sample event as it lands on your bus. They come back ported to Varpulis, with what they catch on that event shape. Free, and no call needed. The button opens your mail client; the address is contact@varpulis-cep.com.