Mars Security Launches Tool That Turns Threat Advisories Into Live Detection Rules in Minutes

Key points

• Mars Security, founded by former military offensive-security operators, launched Real-Time Intel-Based Detection in 2025.
• The platform reads advisories from bodies including CISA, Mandiant, and Microsoft Threat Intelligence, then writes detection rules automatically.
• Every generated rule runs against 30 days of a customer's own historical log data before a human sees it.
• The feature works across tools already in use, including CrowdStrike Falcon, Splunk, and Wiz, without requiring data migration or infrastructure changes.
• Existing Mars customers get the feature at no extra cost, and the platform is available on AWS Marketplace.

Security teams have a persistent problem. A government agency or a respected research firm publishes a detailed report naming the exact techniques a criminal group is using, the exact digital fingerprints to look for. Days or weeks later, analysts are still manually translating that report into a detection rule, the instruction that tells monitoring software what to watch for. By that point, the attackers have moved on.

Mars Security, a startup built by veterans of military offensive-security units, says it has automated that entire gap.

What does the platform actually do?

When an advisory arrives from sources like CISA (the US Cybersecurity and Infrastructure Security Agency), Mandiant, or Microsoft Threat Intelligence, Mars reads it automatically. It pulls out relevant indicators, maps them to MITRE ATT&CK (a publicly maintained catalogue of attacker techniques), and writes detection rules in whatever query language each of a company's existing tools requires, covering everything from CrowdStrike Falcon and Splunk to identity providers and data lakes like Snowflake and Databricks.

Before any rule reaches an analyst's queue, the platform runs it silently against 30 days of the company's own historical log data. That step measures how often the rule would have fired and filters out anything likely to produce too many false alarms. Indicators that are too broad or historically noisy get pruned automatically.

The analyst sees a rule that is already mapped, already tested, and deployable with a single click.

Why does the speed gap matter?

It matters because attackers move faster than manual workflows allow. Our coverage of a CISA red-team exercise published 25 August showed exactly what that lag costs: one organisation let attackers roam for weeks while another caught them almost immediately, and the difference came down to detection readiness. Traditional detection engineering, where a human reads a report, extracts indicators, writes a query, and tunes it against live data, routinely takes days. Criminal groups rotate infrastructure and retool within hours of a public disclosure.

"A SOC should not need a two-week backlog to act on a report that took an attacker two hours to make obsolete," said Ran Lerer, the company's co-founder and CTO. "When the intel lands, the detection should already be written, already tested against your data, and waiting for a click."

Andy Ellis, former chief information security officer at Akamai Technologies, put it in practical terms: "A campaign advisory used to sit in a queue for days before it became a rule anyone trusted. With Mars, it shows up already mapped, already tested against the environment it's meant to protect."

The platform also runs continuous gap analysis in the background, mapping what a company's existing tools can and cannot see, and surfacing blind spots as actionable recommendations or, for teams that manage detection rules as code, as open pull requests ready for review.

Should you worry about the quality of automated rules?

The backtest is the thing worth scrutinising here. Automated rule generation has failed before when the testing step was weak or skipped entirely, leaving analysts buried in alerts that cry wolf. Mars's approach of running every rule against 30 days of a company's own telemetry before it surfaces is the right instinct. Whether the noise-reduction scoring holds up across diverse enterprise environments is a question a proof-of-concept will answer faster than a press release.

What should security teams do with this information?

If your organisation runs a security operations centre and relies on manual detection engineering, test this against your own advisory-to-deployment timeline. Request a demonstration using a recent CISA advisory; the backtest output will tell you quickly whether rule quality holds up in your actual environment.

For end users and customers of organisations using Mars, no direct action is required. This is an internal security tool, not a consumer product.