Security Signal Intelligence API Documentation

POSThttps://www.brainiac.software/api/v1/security-signals/event-correlate$0.05 USDC

Correlate security events

Correlate caller-supplied security events into related incident groups using time windows and shared actor/host/IP links. Observed grouping only—not a confirmed attack.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`correlationWindowMinutes`	No	number
`weakSignalWindowMinutes`	No	number
`sequenceWindowMinutes`	No	number
`bruteForceWindowMinutes`	No	number
`bruteForceFailureThreshold`	No	number
`lowAndSlowFailureThreshold`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "correlationWindowMinutes": 60,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T20:00:00.000Z",
      "eventType": "auth_failure",
      "category": "auth",
      "userId": "u1",
      "host": "vpn-1",
      "sourceIp": "203.0.113.10",
      "outcome": "failure",
      "source": "Caller-supplied SIEM"
    },
    {
      "id": "E2",
      "at": "2026-11-04T20:05:00.000Z",
      "eventType": "auth_success",
      "category": "auth",
      "userId": "u1",
      "host": "vpn-1",
      "sourceIp": "203.0.113.10",
      "outcome": "success",
      "source": "Caller-supplied SIEM"
    },
    {
      "id": "E3",
      "at": "2026-11-04T20:10:00.000Z",
      "eventType": "remote_logon",
      "category": "auth",
      "userId": "u1",
      "host": "app-2",
      "sourceIp": "203.0.113.10",
      "outcome": "success",
      "source": "Caller-supplied SIEM"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "correlated",
  "groupCount": 1,
  "windowMinutes": 60,
  "items": [
    {
      "id": "event-correlate-E1",
      "detector": "event-correlate",
      "title": "Related security event group",
      "status": "signal",
      "observedFacts": [
        "3 events occurred within 60 minutes.",
        "Shared actor keys: u1.",
        "Shared host keys: vpn_1, app_2."
      ],
      "inferredThreat": "Events may belong to one incident cluster based on time proximity and shared actor/host/IP links.",
      "confirmedAttack": false,
      "confidence": "medium",
      "relatedEventIds": [
        "E1",
        "E2",
        "E3"
      ],
      "firstAt": "2026-11-04T20:00:00.000Z",
      "lastAt": "2026-11-04T20:10:00.000Z",
      "reasons": [
        "time_window",
        "shared_actor",
        "shared_host"
      ],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T20:00:00.000Z",
          "fact": "auth_failure on vpn-1 outcome=failure",
          "inference": "Grouped by caller-supplied fields and time proximity only.",
          "confidence": "medium"
        },
        {
          "eventId": "E2",
          "at": "2026-11-04T20:05:00.000Z",
          "fact": "auth_success on vpn-1 outcome=success",
          "inference": "Grouped by caller-supplied fields and time proximity only.",
          "confidence": "medium"
        },
        {
          "eventId": "E3",
          "at": "2026-11-04T20:10:00.000Z",
          "fact": "remote_logon on app-2 outcome=success",
          "inference": "Grouped by caller-supplied fields and time proximity only.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "networkAccessed": false,
  "infrastructureConnected": false,
  "confirmedAttackClaimed": false,
  "findings": [
    {
      "kind": "observation",
      "code": "event_group",
      "subject": "event-correlate-E1",
      "detail": "Correlated 3 events (confidence=medium, confirmedAttack=false)."
    }
  ],
  "limitations": [
    "Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.",
    "Detections are local rule and time-window analyses over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.",
    "No paid threat-intel feed or endpoint agent is used and no API key is required.",
    "Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/security-signals/event-correlate" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "correlationWindowMinutes": 60,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T20:00:00.000Z",
      "eventType": "auth_failure",
      "category": "auth",
      "userId": "u1",
      "host": "vpn-1",
      "sourceIp": "203.0.113.10",
      "outcome": "failure",
      "source": "Caller-supplied SIEM"
    },
    {
      "id": "E2",
      "at": "2026-11-04T20:05:00.000Z",
      "eventType": "auth_success",
      "category": "auth",
      "userId": "u1",
      "host": "vpn-1",
      "sourceIp": "203.0.113.10",
      "outcome": "success",
      "source": "Caller-supplied SIEM"
    },
    {
      "id": "E3",
      "at": "2026-11-04T20:10:00.000Z",
      "eventType": "remote_logon",
      "category": "auth",
      "userId": "u1",
      "host": "app-2",
      "sourceIp": "203.0.113.10",
      "outcome": "success",
      "source": "Caller-supplied SIEM"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/security-signals/weak-signal-detect$0.04 USDC

Detect weak security signals

Identify early suspicious-activity indicators from caller-supplied events. Weak signals are hypotheses with explicit confidence—not confirmed attacks.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`correlationWindowMinutes`	No	number
`weakSignalWindowMinutes`	No	number
`sequenceWindowMinutes`	No	number
`bruteForceWindowMinutes`	No	number
`bruteForceFailureThreshold`	No	number
`lowAndSlowFailureThreshold`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T20:00:00.000Z",
      "eventType": "auth_failure",
      "category": "auth",
      "userId": "u1",
      "host": "vpn-1",
      "outcome": "failure",
      "labels": [
        "first_seen"
      ],
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T20:02:00.000Z",
      "eventType": "recon",
      "userId": "u1",
      "host": "vpn-1",
      "message": "port scan probe",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "signalCount": 2,
  "items": [
    {
      "id": "weak-signal-detect-E1",
      "detector": "weak-signal-detect",
      "title": "Weak suspicious-activity signal",
      "status": "signal",
      "observedFacts": [
        "Observed authentication failure outcome.",
        "Observed anomaly/first-seen labels or wording in supplied data."
      ],
      "inferredThreat": "Early indicator of suspicious activity may be present; not a confirmed attack.",
      "confirmedAttack": false,
      "confidence": "medium",
      "relatedEventIds": [
        "E1",
        "E2"
      ],
      "firstAt": "2026-11-04T20:00:00.000Z",
      "lastAt": "2026-11-04T20:02:00.000Z",
      "reasons": [
        "auth_failure",
        "anomaly_label"
      ],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T20:00:00.000Z",
          "fact": "Observed authentication failure outcome. Observed anomaly/first-seen labels or wording in supplied data.",
          "inference": "1 nearby same-actor events were also supplied.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    },
    {
      "id": "weak-signal-detect-E1",
      "detector": "weak-signal-detect",
      "title": "Weak suspicious-activity signal",
      "status": "signal",
      "observedFacts": [
        "Observed reconnaissance-like keywords in supplied event text."
      ],
      "inferredThreat": "Early indicator of suspicious activity may be present; not a confirmed attack.",
      "confirmedAttack": false,
      "confidence": "medium",
      "relatedEventIds": [
        "E1",
        "E2"
      ],
      "firstAt": "2026-11-04T20:00:00.000Z",
      "lastAt": "2026-11-04T20:02:00.000Z",
      "reasons": [
        "recon_keyword"
      ],
      "evidence": [
        {
          "eventId": "E2",
          "at": "2026-11-04T20:02:00.000Z",
          "fact": "Observed reconnaissance-like keywords in supplied event text.",
          "inference": "1 nearby same-actor events were also supplied.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "networkAccessed": false,
  "infrastructureConnected": false,
  "confirmedAttackClaimed": false,
  "findings": [
    {
      "kind": "observation",
      "code": "weak_signal",
      "subject": "E1",
      "detail": "Weak signal status=signal, confidence=medium."
    },
    {
      "kind": "observation",
      "code": "weak_signal",
      "subject": "E2",
      "detail": "Weak signal status=signal, confidence=medium."
    }
  ],
  "limitations": [
    "Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.",
    "Detections are local rule and time-window analyses over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.",
    "No paid threat-intel feed or endpoint agent is used and no API key is required.",
    "Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/security-signals/weak-signal-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T20:00:00.000Z",
      "eventType": "auth_failure",
      "category": "auth",
      "userId": "u1",
      "host": "vpn-1",
      "outcome": "failure",
      "labels": [
        "first_seen"
      ],
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T20:02:00.000Z",
      "eventType": "recon",
      "userId": "u1",
      "host": "vpn-1",
      "message": "port scan probe",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/security-signals/attack-sequence-detect$0.05 USDC

Detect attack sequences

Detect caller-supplied event sequences that match local attack-pattern rules. Matches are inferred patterns, not confirmed compromises.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`correlationWindowMinutes`	No	number
`weakSignalWindowMinutes`	No	number
`sequenceWindowMinutes`	No	number
`bruteForceWindowMinutes`	No	number
`bruteForceFailureThreshold`	No	number
`lowAndSlowFailureThreshold`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "sequenceWindowMinutes": 180,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T19:00:00.000Z",
      "eventType": "auth_failure",
      "category": "auth",
      "userId": "u9",
      "outcome": "failure",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T19:01:00.000Z",
      "eventType": "auth_failure",
      "category": "auth",
      "userId": "u9",
      "outcome": "failure",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T19:02:00.000Z",
      "eventType": "auth_success",
      "category": "auth",
      "userId": "u9",
      "outcome": "success",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "sequenceCount": 1,
  "items": [
    {
      "id": "attack-sequence-detect-E1",
      "detector": "attack-sequence-detect",
      "title": "Auth failures followed by success",
      "status": "signal",
      "observedFacts": [
        "Step 1: auth_failure at 2026-11-04T19:00:00.000Z",
        "Step 2: auth_success at 2026-11-04T19:02:00.000Z"
      ],
      "inferredThreat": "Supplied events match local sequence pattern \"auth_fail_then_success\" for actor/host key u9. Not a confirmed attack.",
      "confirmedAttack": false,
      "confidence": "medium",
      "relatedEventIds": [
        "E1",
        "E3"
      ],
      "firstAt": "2026-11-04T19:00:00.000Z",
      "lastAt": "2026-11-04T19:02:00.000Z",
      "reasons": [
        "sequence_match",
        "auth_fail_then_success"
      ],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T19:00:00.000Z",
          "fact": "Observed step 1 event.",
          "inference": "Fits pattern auth_fail_then_success within 180 minutes.",
          "confidence": "medium"
        },
        {
          "eventId": "E3",
          "at": "2026-11-04T19:02:00.000Z",
          "fact": "Observed step 2 event.",
          "inference": "Fits pattern auth_fail_then_success within 180 minutes.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "networkAccessed": false,
  "infrastructureConnected": false,
  "confirmedAttackClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "attack_sequence",
      "subject": "attack-sequence-detect-E1",
      "detail": "Sequence pattern auth_fail_then_success matched with confidence=medium; confirmedAttack=false."
    }
  ],
  "limitations": [
    "Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.",
    "Detections are local rule and time-window analyses over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.",
    "No paid threat-intel feed or endpoint agent is used and no API key is required.",
    "Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/security-signals/attack-sequence-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "sequenceWindowMinutes": 180,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T19:00:00.000Z",
      "eventType": "auth_failure",
      "category": "auth",
      "userId": "u9",
      "outcome": "failure",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T19:01:00.000Z",
      "eventType": "auth_failure",
      "category": "auth",
      "userId": "u9",
      "outcome": "failure",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T19:02:00.000Z",
      "eventType": "auth_success",
      "category": "auth",
      "userId": "u9",
      "outcome": "success",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/security-signals/insider-threat-signal-detect$0.05 USDC

Detect insider-threat signals

Identify unusual user activity in caller-supplied logs (off-hours, bulk/export wording, privilege changes). Not a confirmed insider attack.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`correlationWindowMinutes`	No	number
`weakSignalWindowMinutes`	No	number
`sequenceWindowMinutes`	No	number
`bruteForceWindowMinutes`	No	number
`bruteForceFailureThreshold`	No	number
`lowAndSlowFailureThreshold`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T02:10:00.000Z",
      "userId": "contractor-1",
      "action": "download",
      "message": "bulk export sensitive archive",
      "count": 250,
      "source": "Caller-supplied DLP"
    },
    {
      "id": "E2",
      "at": "2026-11-04T02:40:00.000Z",
      "userId": "contractor-1",
      "action": "usb_copy",
      "message": "copy to USB",
      "source": "Caller-supplied DLP"
    },
    {
      "id": "E3",
      "at": "2026-11-04T03:05:00.000Z",
      "userId": "contractor-1",
      "previousPrivilege": "user",
      "privilege": "admin",
      "source": "Caller-supplied IAM"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "signalCount": 1,
  "items": [
    {
      "id": "insider-threat-signal-detect-E1",
      "detector": "insider-threat-signal-detect",
      "title": "Unusual user-activity signal",
      "status": "signal",
      "observedFacts": [
        "3 events occurred in off-hours UTC windows (22:00–05:00).",
        "2 events show bulk/export/sensitive wording or high counts.",
        "1 privilege-change rows were supplied for this user."
      ],
      "inferredThreat": "Unusual activity pattern for user key contractor_1 may indicate insider-threat risk. Not a confirmed insider attack.",
      "confirmedAttack": false,
      "confidence": "medium",
      "relatedEventIds": [
        "E1",
        "E2",
        "E3"
      ],
      "firstAt": "2026-11-04T02:10:00.000Z",
      "lastAt": "2026-11-04T03:05:00.000Z",
      "reasons": [
        "off_hours",
        "bulk_or_sensitive",
        "privilege_change"
      ],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T02:10:00.000Z",
          "fact": "download outcome=unknown",
          "inference": "Evaluated only against caller-supplied user activity rows.",
          "confidence": "medium"
        },
        {
          "eventId": "E2",
          "at": "2026-11-04T02:40:00.000Z",
          "fact": "usb_copy outcome=unknown",
          "inference": "Evaluated only against caller-supplied user activity rows.",
          "confidence": "medium"
        },
        {
          "eventId": "E3",
          "at": "2026-11-04T03:05:00.000Z",
          "fact": "event outcome=unknown",
          "inference": "Evaluated only against caller-supplied user activity rows.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "networkAccessed": false,
  "infrastructureConnected": false,
  "confirmedAttackClaimed": false,
  "findings": [
    {
      "kind": "observation",
      "code": "insider_signal",
      "subject": "contractor_1",
      "detail": "Insider-threat signal status=signal."
    }
  ],
  "limitations": [
    "Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.",
    "Detections are local rule and time-window analyses over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.",
    "No paid threat-intel feed or endpoint agent is used and no API key is required.",
    "Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/security-signals/insider-threat-signal-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T02:10:00.000Z",
      "userId": "contractor-1",
      "action": "download",
      "message": "bulk export sensitive archive",
      "count": 250,
      "source": "Caller-supplied DLP"
    },
    {
      "id": "E2",
      "at": "2026-11-04T02:40:00.000Z",
      "userId": "contractor-1",
      "action": "usb_copy",
      "message": "copy to USB",
      "source": "Caller-supplied DLP"
    },
    {
      "id": "E3",
      "at": "2026-11-04T03:05:00.000Z",
      "userId": "contractor-1",
      "previousPrivilege": "user",
      "privilege": "admin",
      "source": "Caller-supplied IAM"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/security-signals/privilege-escalation-detect$0.04 USDC

Detect privilege-escalation indicators

Detect privilege-escalation indicators from caller-supplied privilege fields and escalation keywords. Not confirmation of successful abuse.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`correlationWindowMinutes`	No	number
`weakSignalWindowMinutes`	No	number
`sequenceWindowMinutes`	No	number
`bruteForceWindowMinutes`	No	number
`bruteForceFailureThreshold`	No	number
`lowAndSlowFailureThreshold`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T18:00:00.000Z",
      "userId": "u2",
      "host": "srv-1",
      "previousPrivilege": "user",
      "privilege": "local-admin",
      "message": "net localgroup administrators add",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "signalCount": 1,
  "items": [
    {
      "id": "privilege-escalation-detect-E1",
      "detector": "privilege-escalation-detect",
      "title": "Privilege-escalation indicator",
      "status": "signal",
      "observedFacts": [
        "Observed privilege change user → local-admin.",
        "Observed privilege-escalation keywords in supplied event text."
      ],
      "inferredThreat": "Privilege escalation may have been attempted or completed. Not confirmed without corroborating controls evidence.",
      "confirmedAttack": false,
      "confidence": "medium",
      "relatedEventIds": [
        "E1"
      ],
      "firstAt": "2026-11-04T18:00:00.000Z",
      "lastAt": "2026-11-04T18:00:00.000Z",
      "reasons": [
        "privilege_field_change",
        "escalation_keyword"
      ],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T18:00:00.000Z",
          "fact": "Observed privilege change user → local-admin. Observed privilege-escalation keywords in supplied event text.",
          "inference": "Local keyword/field rules only; no endpoint agent was queried.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "networkAccessed": false,
  "infrastructureConnected": false,
  "confirmedAttackClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "privilege_escalation",
      "subject": "E1",
      "detail": "Privilege-escalation indicator confidence=medium; confirmedAttack=false."
    }
  ],
  "limitations": [
    "Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.",
    "Detections are local rule and time-window analyses over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.",
    "No paid threat-intel feed or endpoint agent is used and no API key is required.",
    "Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/security-signals/privilege-escalation-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T18:00:00.000Z",
      "userId": "u2",
      "host": "srv-1",
      "previousPrivilege": "user",
      "privilege": "local-admin",
      "message": "net localgroup administrators add",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/security-signals/lateral-movement-detect$0.04 USDC

Detect lateral-movement indicators

Identify suspicious host-to-host movement from caller-supplied network/auth logs. Does not access the caller's network.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`correlationWindowMinutes`	No	number
`weakSignalWindowMinutes`	No	number
`sequenceWindowMinutes`	No	number
`bruteForceWindowMinutes`	No	number
`bruteForceFailureThreshold`	No	number
`lowAndSlowFailureThreshold`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T18:30:00.000Z",
      "userId": "u2",
      "sourceHost": "ws-10",
      "destinationHost": "dc-01",
      "message": "psexec remote exec",
      "outcome": "success",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "signalCount": 1,
  "items": [
    {
      "id": "lateral-movement-detect-E1",
      "detector": "lateral-movement-detect",
      "title": "Lateral-movement indicator",
      "status": "signal",
      "observedFacts": [
        "Observed host-to-host movement ws-10 → dc-01.",
        "Observed lateral-movement tooling/protocol keywords in supplied text."
      ],
      "inferredThreat": "Suspicious movement between systems may be present in supplied network/auth logs. Not a confirmed intrusion.",
      "confirmedAttack": false,
      "confidence": "medium",
      "relatedEventIds": [
        "E1"
      ],
      "firstAt": "2026-11-04T18:30:00.000Z",
      "lastAt": "2026-11-04T18:30:00.000Z",
      "reasons": [
        "host_to_host",
        "lateral_keyword"
      ],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T18:30:00.000Z",
          "fact": "Observed host-to-host movement ws-10 → dc-01. Observed lateral-movement tooling/protocol keywords in supplied text.",
          "inference": "Derived only from caller-supplied source/destination fields and keywords.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "networkAccessed": false,
  "infrastructureConnected": false,
  "confirmedAttackClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "lateral_movement",
      "subject": "E1",
      "detail": "Lateral-movement indicator confidence=medium; confirmedAttack=false."
    }
  ],
  "limitations": [
    "Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.",
    "Detections are local rule and time-window analyses over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.",
    "No paid threat-intel feed or endpoint agent is used and no API key is required.",
    "Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/security-signals/lateral-movement-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T18:30:00.000Z",
      "userId": "u2",
      "sourceHost": "ws-10",
      "destinationHost": "dc-01",
      "message": "psexec remote exec",
      "outcome": "success",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/security-signals/account-takeover-signal-detect$0.05 USDC

Detect account-takeover signals

Identify account-takeover indicators when multiple distinct signals appear for the same user (geo/device/MFA/recovery). Not a confirmed takeover.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`correlationWindowMinutes`	No	number
`weakSignalWindowMinutes`	No	number
`sequenceWindowMinutes`	No	number
`bruteForceWindowMinutes`	No	number
`bruteForceFailureThreshold`	No	number
`lowAndSlowFailureThreshold`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T17:00:00.000Z",
      "userId": "u3",
      "eventType": "password_reset",
      "message": "password reset",
      "source": "Caller-supplied IdP"
    },
    {
      "id": "E2",
      "at": "2026-11-04T17:05:00.000Z",
      "userId": "u3",
      "eventType": "auth_success",
      "outcome": "success",
      "previousGeoCountry": "US",
      "geoCountry": "RO",
      "previousDeviceId": "dev-a",
      "deviceId": "dev-b",
      "mfaUsed": false,
      "source": "Caller-supplied IdP"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "signalCount": 1,
  "items": [
    {
      "id": "account-takeover-signal-detect-E1",
      "detector": "account-takeover-signal-detect",
      "title": "Account-takeover indicator set",
      "status": "signal",
      "observedFacts": [
        "1 geo-change rows were supplied.",
        "1 device-change rows were supplied.",
        "1 events indicate MFA absent/bypass wording or successful auth without MFA when mfaUsed=false.",
        "Observed recovery/reset wording and a successful auth event for the same user key."
      ],
      "inferredThreat": "Account takeover indicators for user key u3 were observed across multiple signal types. Not a confirmed takeover.",
      "confirmedAttack": false,
      "confidence": "high",
      "relatedEventIds": [
        "E1",
        "E2"
      ],
      "firstAt": "2026-11-04T17:00:00.000Z",
      "lastAt": "2026-11-04T17:05:00.000Z",
      "reasons": [
        "impossible_or_changed_travel",
        "new_device",
        "mfa_gap",
        "recovery_then_login"
      ],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T17:00:00.000Z",
          "fact": "password_reset geo=n/a device=n/a",
          "inference": "Requires multiple distinct indicator kinds before status=signal.",
          "confidence": "high"
        },
        {
          "eventId": "E2",
          "at": "2026-11-04T17:05:00.000Z",
          "fact": "auth_success geo=RO device=dev-b",
          "inference": "Requires multiple distinct indicator kinds before status=signal.",
          "confidence": "high"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "networkAccessed": false,
  "infrastructureConnected": false,
  "confirmedAttackClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "account_takeover",
      "subject": "u3",
      "detail": "ATO signal status=signal, confidence=high; confirmedAttack=false."
    }
  ],
  "limitations": [
    "Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.",
    "Detections are local rule and time-window analyses over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.",
    "No paid threat-intel feed or endpoint agent is used and no API key is required.",
    "Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/security-signals/account-takeover-signal-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T17:00:00.000Z",
      "userId": "u3",
      "eventType": "password_reset",
      "message": "password reset",
      "source": "Caller-supplied IdP"
    },
    {
      "id": "E2",
      "at": "2026-11-04T17:05:00.000Z",
      "userId": "u3",
      "eventType": "auth_success",
      "outcome": "success",
      "previousGeoCountry": "US",
      "geoCountry": "RO",
      "previousDeviceId": "dev-a",
      "deviceId": "dev-b",
      "mfaUsed": false,
      "source": "Caller-supplied IdP"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/security-signals/credential-abuse-detect$0.04 USDC

Detect credential-abuse patterns

Detect suspicious credential usage such as repeated failures, fail-then-success, or reuse across many hosts from caller-supplied auth events.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`correlationWindowMinutes`	No	number
`weakSignalWindowMinutes`	No	number
`sequenceWindowMinutes`	No	number
`bruteForceWindowMinutes`	No	number
`bruteForceFailureThreshold`	No	number
`lowAndSlowFailureThreshold`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T16:00:00.000Z",
      "username": "svc-backup",
      "host": "db-1",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "198.51.100.8",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T16:01:00.000Z",
      "username": "svc-backup",
      "host": "db-2",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "198.51.100.8",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T16:02:00.000Z",
      "username": "svc-backup",
      "host": "db-3",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "198.51.100.8",
      "source": "Caller-supplied"
    },
    {
      "id": "E4",
      "at": "2026-11-04T16:03:00.000Z",
      "username": "svc-backup",
      "host": "db-3",
      "outcome": "success",
      "category": "auth",
      "sourceIp": "198.51.100.8",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "signalCount": 1,
  "items": [
    {
      "id": "credential-abuse-detect-E1",
      "detector": "credential-abuse-detect",
      "title": "Credential-abuse pattern",
      "status": "signal",
      "observedFacts": [
        "3 authentication failures were supplied for credential key svc_backup_198_51_100_8.",
        "Observed failures and at least one success for the same credential/source key.",
        "Credential/source key touched 3 distinct hosts."
      ],
      "inferredThreat": "Suspicious credential usage pattern may be present. Not confirmation that credentials were compromised.",
      "confirmedAttack": false,
      "confidence": "medium",
      "relatedEventIds": [
        "E1",
        "E2",
        "E3",
        "E4"
      ],
      "firstAt": "2026-11-04T16:00:00.000Z",
      "lastAt": "2026-11-04T16:03:00.000Z",
      "reasons": [
        "repeated_failures",
        "fail_then_success",
        "spray_or_reuse_across_hosts"
      ],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T16:00:00.000Z",
          "fact": "outcome=failure host=db-1",
          "inference": "Pattern derived from caller-supplied auth outcomes and host fan-out.",
          "confidence": "medium"
        },
        {
          "eventId": "E2",
          "at": "2026-11-04T16:01:00.000Z",
          "fact": "outcome=failure host=db-2",
          "inference": "Pattern derived from caller-supplied auth outcomes and host fan-out.",
          "confidence": "medium"
        },
        {
          "eventId": "E3",
          "at": "2026-11-04T16:02:00.000Z",
          "fact": "outcome=failure host=db-3",
          "inference": "Pattern derived from caller-supplied auth outcomes and host fan-out.",
          "confidence": "medium"
        },
        {
          "eventId": "E4",
          "at": "2026-11-04T16:03:00.000Z",
          "fact": "outcome=success host=db-3",
          "inference": "Pattern derived from caller-supplied auth outcomes and host fan-out.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "networkAccessed": false,
  "infrastructureConnected": false,
  "confirmedAttackClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "credential_abuse",
      "subject": "svc_backup_198_51_100_8",
      "detail": "Credential-abuse signal status=signal; confirmedAttack=false."
    }
  ],
  "limitations": [
    "Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.",
    "Detections are local rule and time-window analyses over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.",
    "No paid threat-intel feed or endpoint agent is used and no API key is required.",
    "Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/security-signals/credential-abuse-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T16:00:00.000Z",
      "username": "svc-backup",
      "host": "db-1",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "198.51.100.8",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T16:01:00.000Z",
      "username": "svc-backup",
      "host": "db-2",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "198.51.100.8",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T16:02:00.000Z",
      "username": "svc-backup",
      "host": "db-3",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "198.51.100.8",
      "source": "Caller-supplied"
    },
    {
      "id": "E4",
      "at": "2026-11-04T16:03:00.000Z",
      "username": "svc-backup",
      "host": "db-3",
      "outcome": "success",
      "category": "auth",
      "sourceIp": "198.51.100.8",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/security-signals/brute-force-pattern-detect$0.04 USDC

Detect brute-force patterns

Identify burst, distributed, and low-and-slow brute-force patterns from caller-supplied authentication failures.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`correlationWindowMinutes`	No	number
`weakSignalWindowMinutes`	No	number
`sequenceWindowMinutes`	No	number
`bruteForceWindowMinutes`	No	number
`bruteForceFailureThreshold`	No	number
`lowAndSlowFailureThreshold`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "bruteForceWindowMinutes": 30,
  "bruteForceFailureThreshold": 5,
  "lowAndSlowFailureThreshold": 4,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T15:00:00.000Z",
      "username": "admin",
      "host": "ssh-1",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "203.0.113.1",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T15:01:00.000Z",
      "username": "admin",
      "host": "ssh-1",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "203.0.113.2",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T15:02:00.000Z",
      "username": "admin",
      "host": "ssh-1",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "203.0.113.3",
      "source": "Caller-supplied"
    },
    {
      "id": "E4",
      "at": "2026-11-04T15:03:00.000Z",
      "username": "admin",
      "host": "ssh-1",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "203.0.113.4",
      "source": "Caller-supplied"
    },
    {
      "id": "E5",
      "at": "2026-11-04T15:04:00.000Z",
      "username": "admin",
      "host": "ssh-1",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "203.0.113.5",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "patternCount": 1,
  "items": [
    {
      "id": "brute-force-pattern-detect-E1",
      "detector": "brute-force-pattern-detect",
      "title": "Distributed brute-force pattern",
      "status": "signal",
      "observedFacts": [
        "5 auth failures toward admin_ssh_1 within 30 minutes.",
        "Distinct sources observed: 5.",
        "Failure span: 4 minutes."
      ],
      "inferredThreat": "Brute-force style authentication pressure may be occurring. Not confirmation that an account was breached.",
      "confirmedAttack": false,
      "confidence": "high",
      "relatedEventIds": [
        "E1",
        "E2",
        "E3",
        "E4",
        "E5"
      ],
      "firstAt": "2026-11-04T15:00:00.000Z",
      "lastAt": "2026-11-04T15:04:00.000Z",
      "reasons": [
        "burst_failures",
        "distributed_sources"
      ],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T15:00:00.000Z",
          "fact": "Auth failure from 203.0.113.1",
          "inference": "Counted only caller-supplied failure outcomes in the time window.",
          "confidence": "high"
        },
        {
          "eventId": "E2",
          "at": "2026-11-04T15:01:00.000Z",
          "fact": "Auth failure from 203.0.113.2",
          "inference": "Counted only caller-supplied failure outcomes in the time window.",
          "confidence": "high"
        },
        {
          "eventId": "E3",
          "at": "2026-11-04T15:02:00.000Z",
          "fact": "Auth failure from 203.0.113.3",
          "inference": "Counted only caller-supplied failure outcomes in the time window.",
          "confidence": "high"
        },
        {
          "eventId": "E4",
          "at": "2026-11-04T15:03:00.000Z",
          "fact": "Auth failure from 203.0.113.4",
          "inference": "Counted only caller-supplied failure outcomes in the time window.",
          "confidence": "high"
        },
        {
          "eventId": "E5",
          "at": "2026-11-04T15:04:00.000Z",
          "fact": "Auth failure from 203.0.113.5",
          "inference": "Counted only caller-supplied failure outcomes in the time window.",
          "confidence": "high"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "networkAccessed": false,
  "infrastructureConnected": false,
  "confirmedAttackClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "brute_force",
      "subject": "brute-force-pattern-detect-E1",
      "detail": "Brute-force pattern reasons=burst_failures, distributed_sources; confirmedAttack=false."
    }
  ],
  "limitations": [
    "Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.",
    "Detections are local rule and time-window analyses over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.",
    "No paid threat-intel feed or endpoint agent is used and no API key is required.",
    "Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/security-signals/brute-force-pattern-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "bruteForceWindowMinutes": 30,
  "bruteForceFailureThreshold": 5,
  "lowAndSlowFailureThreshold": 4,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T15:00:00.000Z",
      "username": "admin",
      "host": "ssh-1",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "203.0.113.1",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T15:01:00.000Z",
      "username": "admin",
      "host": "ssh-1",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "203.0.113.2",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T15:02:00.000Z",
      "username": "admin",
      "host": "ssh-1",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "203.0.113.3",
      "source": "Caller-supplied"
    },
    {
      "id": "E4",
      "at": "2026-11-04T15:03:00.000Z",
      "username": "admin",
      "host": "ssh-1",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "203.0.113.4",
      "source": "Caller-supplied"
    },
    {
      "id": "E5",
      "at": "2026-11-04T15:04:00.000Z",
      "username": "admin",
      "host": "ssh-1",
      "outcome": "failure",
      "category": "auth",
      "sourceIp": "203.0.113.5",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/security-signals/event-severity-score$0.05 USDC

Score security-event severity

Calculate an explainable severity score for detections derived from caller-supplied events, with scoring breakdown and confirmedAttack=false.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`correlationWindowMinutes`	No	number
`weakSignalWindowMinutes`	No	number
`sequenceWindowMinutes`	No	number
`bruteForceWindowMinutes`	No	number
`bruteForceFailureThreshold`	No	number
`lowAndSlowFailureThreshold`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T19:00:00.000Z",
      "eventType": "auth_failure",
      "category": "auth",
      "userId": "u9",
      "outcome": "failure",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T19:02:00.000Z",
      "eventType": "auth_success",
      "category": "auth",
      "userId": "u9",
      "outcome": "success",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T19:10:00.000Z",
      "userId": "u9",
      "sourceHost": "ws-1",
      "destinationHost": "db-1",
      "message": "winrm lateral",
      "outcome": "success",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "scored",
  "scoredCount": 5,
  "topScore": 36,
  "topBand": "low",
  "items": [
    {
      "id": "attack-sequence-detect-E1",
      "detector": "attack-sequence-detect",
      "title": "Auth failures followed by success",
      "status": "signal",
      "score": 36,
      "band": "low",
      "confirmedAttack": false,
      "confidence": "medium",
      "relatedEventIds": [
        "E1",
        "E2"
      ],
      "firstAt": "2026-11-04T19:00:00.000Z",
      "lastAt": "2026-11-04T19:02:00.000Z",
      "reasons": [
        "sequence_match",
        "auth_fail_then_success"
      ],
      "observedFacts": [
        "Step 1: auth_failure at 2026-11-04T19:00:00.000Z",
        "Step 2: auth_success at 2026-11-04T19:02:00.000Z"
      ],
      "inferredThreat": "Supplied events match local sequence pattern \"auth_fail_then_success\" for actor/host key u9. Not a confirmed attack.",
      "scoringBreakdown": [
        {
          "component": "detector_weight",
          "points": 28
        },
        {
          "component": "confidence_boost",
          "points": 4
        },
        {
          "component": "related_event_bonus",
          "points": 4
        }
      ],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T19:00:00.000Z",
          "fact": "Observed step 1 event.",
          "inference": "Fits pattern auth_fail_then_success within 180 minutes.",
          "confidence": "medium"
        },
        {
          "eventId": "E2",
          "at": "2026-11-04T19:02:00.000Z",
          "fact": "Observed step 2 event.",
          "inference": "Fits pattern auth_fail_then_success within 180 minutes.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    },
    {
      "id": "attack-sequence-detect-E2",
      "detector": "attack-sequence-detect",
      "title": "Successful access then host-to-host movement",
      "status": "signal",
      "score": 36,
      "band": "low",
      "confirmedAttack": false,
      "confidence": "medium",
      "relatedEventIds": [
        "E2",
        "E3"
      ],
      "firstAt": "2026-11-04T19:02:00.000Z",
      "lastAt": "2026-11-04T19:10:00.000Z",
      "reasons": [
        "sequence_match",
        "access_then_lateral"
      ],
      "observedFacts": [
        "Step 1: auth_success at 2026-11-04T19:02:00.000Z",
        "Step 2: winrm lateral at 2026-11-04T19:10:00.000Z"
      ],
      "inferredThreat": "Supplied events match local sequence pattern \"access_then_lateral\" for actor/host key u9. Not a confirmed attack.",
      "scoringBreakdown": [
        {
          "component": "detector_weight",
          "points": 28
        },
        {
          "component": "confidence_boost",
          "points": 4
        },
        {
          "component": "related_event_bonus",
          "points": 4
        }
      ],
      "evidence": [
        {
          "eventId": "E2",
          "at": "2026-11-04T19:02:00.000Z",
          "fact": "Observed step 1 event.",
          "inference": "Fits pattern access_then_lateral within 180 minutes.",
          "confidence": "medium"
        },
        {
          "eventId": "E3",
          "at": "2026-11-04T19:10:00.000Z",
          "fact": "Observed step 2 event.",
          "inference": "Fits pattern access_then_lateral within 180 minutes.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    },
    {
      "id": "lateral-movement-detect-E3",
      "detector": "lateral-movement-detect",
      "title": "Lateral-movement indicator",
      "status": "signal",
      "score": 28,
      "band": "low",
      "confirmedAttack": false,
      "confidence": "medium",
      "relatedEventIds": [
        "E3"
      ],
      "firstAt": "2026-11-04T19:10:00.000Z",
      "lastAt": "2026-11-04T19:10:00.000Z",
      "reasons": [
        "host_to_host",
        "lateral_keyword"
      ],
      "observedFacts": [
        "Observed host-to-host movement ws-1 → db-1.",
        "Observed lateral-movement tooling/protocol keywords in supplied text."
      ],
      "inferredThreat": "Suspicious movement between systems may be present in supplied network/auth logs. Not a confirmed intrusion.",
      "scoringBreakdown": [
        {
          "component": "detector_weight",
          "points": 22
        },
        {
          "component": "confidence_boost",
          "points": 4
        },
        {
          "component": "related_event_bonus",
          "points": 2
        }
      ],
      "evidence": [
        {
          "eventId": "E3",
          "at": "2026-11-04T19:10:00.000Z",
          "fact": "Observed host-to-host movement ws-1 → db-1. Observed lateral-movement tooling/protocol keywords in supplied text.",
          "inference": "Derived only from caller-supplied source/destination fields and keywords.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    },
    {
      "id": "credential-abuse-detect-E1",
      "detector": "credential-abuse-detect",
      "title": "Credential-abuse pattern",
      "status": "signal",
      "score": 24,
      "band": "low",
      "confirmedAttack": false,
      "confidence": "low",
      "relatedEventIds": [
        "E1",
        "E2",
        "E3"
      ],
      "firstAt": "2026-11-04T19:00:00.000Z",
      "lastAt": "2026-11-04T19:10:00.000Z",
      "reasons": [
        "fail_then_success"
      ],
      "observedFacts": [
        "Observed failures and at least one success for the same credential/source key."
      ],
      "inferredThreat": "Suspicious credential usage pattern may be present. Not confirmation that credentials were compromised.",
      "scoringBreakdown": [
        {
          "component": "detector_weight",
          "points": 18
        },
        {
          "component": "confidence_boost",
          "points": 0
        },
        {
          "component": "related_event_bonus",
          "points": 6
        }
      ],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T19:00:00.000Z",
          "fact": "outcome=failure host=n/a",
          "inference": "Pattern derived from caller-supplied auth outcomes and host fan-out.",
          "confidence": "low"
        },
        {
          "eventId": "E2",
          "at": "2026-11-04T19:02:00.000Z",
          "fact": "outcome=success host=n/a",
          "inference": "Pattern derived from caller-supplied auth outcomes and host fan-out.",
          "confidence": "low"
        },
        {
          "eventId": "E3",
          "at": "2026-11-04T19:10:00.000Z",
          "fact": "outcome=success host=db-1",
          "inference": "Pattern derived from caller-supplied auth outcomes and host fan-out.",
          "confidence": "low"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    },
    {
      "id": "weak-signal-detect-E1",
      "detector": "weak-signal-detect",
      "title": "Weak suspicious-activity signal",
      "status": "signal",
      "score": 18,
      "band": "low",
      "confirmedAttack": false,
      "confidence": "medium",
      "relatedEventIds": [
        "E1",
        "E2",
        "E3"
      ],
      "firstAt": "2026-11-04T19:00:00.000Z",
      "lastAt": "2026-11-04T19:10:00.000Z",
      "reasons": [
        "auth_failure"
      ],
      "observedFacts": [
        "Observed authentication failure outcome."
      ],
      "inferredThreat": "Early indicator of suspicious activity may be present; not a confirmed attack.",
      "scoringBreakdown": [
        {
          "component": "detector_weight",
          "points": 8
        },
        {
          "component": "confidence_boost",
          "points": 4
        },
        {
          "component": "related_event_bonus",
          "points": 6
        }
      ],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T19:00:00.000Z",
          "fact": "Observed authentication failure outcome.",
          "inference": "2 nearby same-actor events were also supplied.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied events; local rules only"
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "networkAccessed": false,
  "infrastructureConnected": false,
  "confirmedAttackClaimed": false,
  "findings": [
    {
      "kind": "observation",
      "code": "severity_score",
      "subject": "weak-signal-detect-E1",
      "detail": "Explainable severity 18 (low) for weak-signal-detect."
    },
    {
      "kind": "observation",
      "code": "severity_score",
      "subject": "attack-sequence-detect-E1",
      "detail": "Explainable severity 36 (low) for attack-sequence-detect."
    },
    {
      "kind": "observation",
      "code": "severity_score",
      "subject": "attack-sequence-detect-E2",
      "detail": "Explainable severity 36 (low) for attack-sequence-detect."
    },
    {
      "kind": "observation",
      "code": "severity_score",
      "subject": "lateral-movement-detect-E3",
      "detail": "Explainable severity 28 (low) for lateral-movement-detect."
    },
    {
      "kind": "observation",
      "code": "severity_score",
      "subject": "credential-abuse-detect-E1",
      "detail": "Explainable severity 24 (low) for credential-abuse-detect."
    }
  ],
  "limitations": [
    "Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.",
    "Detections are local rule and time-window analyses over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.",
    "No paid threat-intel feed or endpoint agent is used and no API key is required.",
    "Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/security-signals/event-severity-score" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T19:00:00.000Z",
      "eventType": "auth_failure",
      "category": "auth",
      "userId": "u9",
      "outcome": "failure",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T19:02:00.000Z",
      "eventType": "auth_success",
      "category": "auth",
      "userId": "u9",
      "outcome": "success",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T19:10:00.000Z",
      "userId": "u9",
      "sourceHost": "ws-1",
      "destinationHost": "db-1",
      "message": "winrm lateral",
      "outcome": "success",
      "source": "Caller-supplied"
    }
  ]
}
JSON