Detections as code are code. Agents write and tune them.

Cotool detections are Python code that runs against both centralized and federated data sources. Your team edits them in a notebook alongside detection engineering agents that tune your library and write new detections continuously.

Detection/personal_cloud_exfil.pyPython notebook

Visual Code

Exfiltration to personal cloud storageT1567.002

LOOKBACK = 30 # days of history per user

SPIKE = 20 # flag days this many times their normal

CATEGORY = "personal-storage"

ParametersLOOKBACK 30 · SPIKE 20× · personal-storageConfig

Query proxy logsUploads to personal storage, 30 daysSource

Model each user's normal30-day rolling median per userTransform

Find spikesDays over 20× the user's normalDecision

Flag leaversJoins each spike with a last dayEnrich

Ask RipplingLast day for each user

Exclude company BoxAdded by the tuning agentv2

Return alertsOne alert per remaining spike1 alert · m.chen

Detections are Code

Detections optimized for agents

Every detection under the hood is pure code, what agents write best. A single detection can model baselines and deviations, call any tool in your stack, and apply any deterministic logic you want. Detection code is mapped to a dead-simple visual workflow, so the logic is clear to the entire team.

okta_mfa_fatigue.py

Visual Code

MFA push fatigue

WINDOW_MIN = 10

MIN_DENIES = 5 # edited in Visual

denies = tools.cotool_runQuery(query=f"""

SELECT actor_id, COUNT(*) AS denies

FROM cotool_logs.okta

WHERE event_type = 'user.mfa.okta_verify.deny_push'

AND ts > now() - INTERVAL {WINDOW_MIN} MINUTE

GROUP BY actor_id

""")

hits = [d for d in denies if d["denies"] >= MIN_DENIES]

emit_results(hits)

Set thresholds

WINDOW_MIN 10 · MIN_DENIES 5

Configuration

Query Okta push denials

Reads cotool_logs.okta for denied Okta Verify pushes

Source

Count denials per user

Groups by actor over the last 10 minutes

Transform

Flag push fatigue

Keeps users with 5 or more denials

Decision

Return results

Emits each flagged user as an alert

Output

Closed-Loop Tuning

Every detection, tuned automatically

Agents investigate every alert, and each verdict feeds back into the detection that fired it. False positives get tuned out on their own, so your queue only holds what needs a human and you can ship new detections without bracing for noise.

Proposed tuninggws_oauth_grant.py

Tuning agent· from 136 false positives closed in triage

1alerts = grants.where(scope__in=SENSITIVE_SCOPES)

2+# Security's register of approved OAuth apps

3+trusted = notion.query("Approved apps")["Client ID"]

4+alerts = alerts.exclude(client_id__in=trusted)

Alerts in a 30-day backtestTrue positive

142→1426 of 6 true positives still fire

v5 liveSend for reviewApply tuning

Federated detections

Detect on data you don't store

A detection can run against logs in Cotool or directly against the tools where your data already lives. You don't have to ingest a source to cover it. Store what needs fast search and long retention, and write detections against the rest where it is.

leaver_still_active.pyNo log source

Terminated but still activeT1078Every hour

leavers = tools.call("rippling_queryWorkers",

status="TERMINATED")

Rippling · 4 terminated workers

active = tools.call("okta_listUsers",

filter='status eq "ACTIVE"')

Okta · 212 active users

gone = {w["work_email"] for w in leavers}

emit_results([u for u in active if u["email"] in gone])

1 result

m.ortiz left Sep 26 and is still active in OktaSent to triage

Detection Library & Coverage Mapping

Start with coverage, then close the gaps

Cotool comes with a library of detections across common log sources, automatically tuned to your environment by agents. Cotool maps your entire detection suite onto the MITRE ATT&CK framework, prioritizing gaps and creating new contextualized detections for any tactic or technique.

Coverage31 of 40 techniques

Initial

Exec

Persist

Priv Esc

Evasion

Cred

Lateral

Exfil

T1550.004 Web Session CookieLow · 1 detection

okta_session_replay_drive.pyLive

Okta session replay followed by Finance Drive access

Okta System Log+

Drive audit

Reject Approve

Runs every 15 min on Okta and Google Workspace

Scale detection in a completely new way

2,000 Employee Crypto Exchange1,500+ Employee Security Company

See how teams run continuous detection across live logs without writing rules for every edge case

Book a demo

Extended Features

Read the docs

GitOps

Keep detections in your own repository. Review changes in pull requests and deploy through CI.

Tune MFA fatigue threshold#214 Open

tune-mfa-fatigue→mainOpened by Cotool agent

detections/okta/mfa_fatigue.py

1denied = pushes.window("10m").group_by("actor.id")

2-alerts = denied.count().where(lambda n: n >= 3)

3+alerts = denied.count().where(lambda n: n >= 5)

4+alerts = alerts.exclude(actor__in=SERVICE_ACCOUNTS)

ChecksDeploys on merge

cotool validatePassed

cotool backtest --days 30−71% alerts, 0 missed

review1 approval

Write detections with your coding agent

Cotool's MCP server lets Claude Code, Codex, Cursor, or any agent harness write, test, and deploy detections from your editor.

~/detections cotool MCP connected

> Write a detection for AWS access keys created outside Terraform

● cotool.search_logs source="cloudtrail"

└ 1,204 CreateAccessKey events, 30 days

● cotool.create_detection access_key_outside_iac.py

└ Created, 24 lines

● cotool.test_detection window="30d"

└ 2 hits, 0 false positives

● cotool.deploy_detection

└ Live, runs every 15 minutes

Deployed. It flagged 2 keys created from the console last week.

New detections from threat hunts

Hunts and threat intel produce detection suggestions around the clock, ready for your review.

AMBER MAZE targets developer AI sessions and cloud credentials

Cotool Threat ResearchWhat Cotool checked

Anthropic Compliance1 agent session with unexpected egress

SentinelOneProcess tree pulled for MBP-117

GitHubNo repos reference cdn-checker.menlolabs.com

Deliverables2 detections

Hijacked AI agent sessionT1059T1552.001T1041

Shipped

Coding agent credential pivot from untrusted instructionsT1552.001T1071.001

In review

Detection observability built-in

Every detection run is logged and searchable. Re-enter any execution to view all tool inputs and outputs and ask follow up questions.

Detection load heatmap014 runs / day

MTWTFSSMTWTFTotal

rclone_exfil.py84Healthy

okta_mfa_fatigue.py29Healthy

okta_session_reuse.py12Healthy

gws_oauth_consent.py10Healthy

aws_root_login.py3Healthy

↑ rclone_exfil.py v6 shipped

Completed runs

138

Failed runs

Detections tuned

Executionsrclone_exfil.py

Scheduled Succeededjust now12s4 rows

Scheduled Succeeded15m ago11s0 rows

Manual Succeeded1h ago14s6 rows

“It's enabled us to comfortably onboard new log sources and write rules around them without worrying that we're going to cause alert fatigue for the human detection engineers and analysts on the team.”

Antoinette Stevens

Principal Security Engineer