FAQ

FAQ

Is Prohori a SIEM replacement? No. It is a compact, laptop-sized toolkit for learning, small deployments and offline triage.

Does it need paid services or the cloud? No. Everything works offline. Enrichment and the LLM analyst use optional free tiers.

Will it block attackers automatically? No. Prohori only recommends actions; a human decides.

Does the simulator attack anything? No. It writes log lines to files and never touches a network. All addresses come from documentation ranges.

Is the rule format Sigma? It is inspired by Sigma but is a smaller, documented format with thresholds and sequences. It does not claim Sigma compatibility.

Why might the machine-learning numbers be lower than in some papers? Prohori removes duplicates and identifier columns, fits transforms on training data only, freezes thresholds before testing and reports cross-dataset results. Honest numbers are usually lower.

Does my data get sent to an LLM? Only if you explicitly enable the analyst, and incidents are redacted first.