Published on: Eventus Engineering Blog (eventus.blog)
Author: Eventus Technologies Engineering Team

At 9:02 on Monday morning, a public-facing firewall starts recording a port scan.

By 9:05, the SIEM has generated 5,000 alerts. The IT lead opens the dashboard, sees a wall of red, and asks the question every small security team eventually asks:

“Can’t we just put AI on top of the SIEM and have it tell us what matters?”

It is a reasonable question. The right direction is, in fact, AI on top of SIEM. Your existing SIEM already collects events, applies detection rules, and stores the evidence. An AI layer can translate that output into priorities, explanations, and next actions.

That is the idea behind SIEM+, an AI security overlay for teams that want better triage and clearer security posture without replacing the SIEM they already operate.

A generic chatbot, a one-off LLM script, or a loosely connected AI copilot may produce an impressive answer to one alert. Security operations require something more durable: a system that remembers context, groups related evidence, respects data boundaries, tracks posture over time, and produces outputs people can act on and defend later.

Published on: Eventus Engineering Blog (eventus.blog) Author: Eventus Technologies Engineering Team

Every audit season, the same scene plays out. A security team exports a mountain of raw logs, a spreadsheet of alert counts, and a screenshot of a dashboard covered in red and yellow blocks. They hand it to the auditor and hope for the best.

The auditor doesn't want any of that. They want one question answered clearly: "Can you prove this control is working, and show me the evidence?" If the answer takes twenty minutes of dashboard-squinting to extract, you've already failed the real test — not of your security posture, but of your ability to communicate it.

This is the problem we built the SIEM+ (siem.plus) Auditor View to solve. Not "more visibility." Comprehensible visibility — audit-ready by default, not audit-ready after a week of manual report building.

We’re pleased to share a new Eventus article on Qiita: “The Full Story of SEKHMET, a Software-Defined Gateway That Eliminates Dedicated Hardware.”

Published in Japanese, the article introduces our vision for making IoT deployments lighter and more accessible. Instead of requiring a dedicated gateway for every project, SEKHMET uses software on existing smartphones and tablets to connect sensors, process data at the edge, and link operational information with cloud services.

Published on: Eventus Engineering Blog (eventus.blog)
Author: Eventus Technologies Engineering Team

In the cybersecurity industry, we have a terrible habit of equating “volume” with “risk.” If a traditional SIEM dashboard shows 10,000 alerts, the status indicator turns red, the posture score plummets to zero, and executives panic.

But as any Tier-1 SOC analyst knows, a simple automated port scan against a public-facing IP can generate 5,000 raw firewall drops in three minutes. That isn’t 5,000 separate critical threats; it is a single, low-level event.

When we built SIEM+ (siem.plus), we knew that if we just fed raw alert counts into a UI, we would be recreating the exact same “alert fatigue” we set out to destroy. We needed a way to translate noisy data lakes into a boardroom-ready metric that reflects actual risk.

Here is a deep dive into how we engineered the SIEM+ Dynamic Posture Score, our penalty decay algorithm, and how we force LLMs to map threats to compliance frameworks without hallucinating.

Eventus is pleased to announce that we have joined Qiita, Japan's technology knowledge-sharing platform, to make our practical experience more accessible to engineers, IT teams, and technology leaders.

Qiita gives us a place to share what we learn while helping organizations improve security operations, use cloud technologies effectively, and turn operational data into better decisions.