Everything you need.
Nothing you don't.
RookGuard unifies 64 cybersecurity features in a single platform: detection, investigation, response, compliance and intelligence. Every module is designed to work with the others — not to sell you another upsell.
24/7 human monitoring
French-speaking analysts based in France, on duty day and night.
Automatic triage
Alert prioritization by criticality and business context.
NIS2 Playbooks
Over 40 pre-wired runbooks for every incident type.
Smart escalation
Targeted notification based on severity and time of day.
Digital forensics
Complete post-incident analysis with chain of evidence.
Proactive threat hunting
Active search for dormant threats in your environment.
Dedicated analyst
Named contact for Enterprise and MSP plans.
ANSSI reports
Automated incident declaration in regulatory format.
Multi-source collection
Unlimited log ingestion from any source.
Real-time correlation
Continuous analysis, detection in under 30 seconds.
Native Sigma rules
Over 3,000 community-maintained open source rules.
MITRE ATT&CK
Complete mapping of adversary tactics and techniques.
12-month retention
Long-term storage included with no per-GB surcharge.
Full-text search
Ultra-fast engine across all historical logs.
Customizable parsers
Create parsers for your proprietary sources.
IoC enrichment
Geolocation, WHOIS, live IP and domain reputation.
Custom dashboards
Customizable dashboards by team and role.
Multi-channel alerts
Email, Slack, Teams, webhook, SMS — you choose.
Lightweight endpoint agent
Under 30 MB in memory, CPU impact below 2%.
Behavioral EDR
Detection through process analysis, not signatures.
Network NDR
Lateral traffic analysis to detect adversary movement.
Cloud CWPP
AWS, Azure, GCP and OVH protection with configuration scanning.
Identity ITDR
Account abuse and privilege escalation detection.
Email protection
Anti-phishing filtering, attachment sandboxing.
Automatic isolation
Immediate quarantine of compromised machines.
Ransomware rollback
Instant restoration of encrypted files.
Process tree
Graphical visualization of an attack execution chain.
Dynamic sandboxing
Automatic detonation of suspicious files in an isolated environment.
Alert explanation
Every alert decoded in clear language, understandable by non-experts.
Suggested remediation
Concrete action proposals with ready-to-use commands.
Executive reports
Automatic generation of monthly executive summaries.
NIS2 Audit
Automatic compliance check with per-domain scoring.
Contextual chat
Ask your questions, get sourced answers.
AI Sovereignty
No data leaves Europe. No training on your data.
Automatic inventory
Continuous discovery of all assets connected to your network.
Continuous CVE scanning
Known vulnerability detection without manual intervention.
Risk-based prioritization
EPSS ranking + business context to focus effort.
Patching workflows
Patch campaign orchestration with tracking.
Remediation tracking
Vulnerability lifecycle tracking from detection to closure.
Shodan integration
Monitoring your public Internet exposure.
NIS2 Mapping
All NIS2 controls mapped and tracked automatically.
Evidence collection
Automatic capture of compliance evidence for audits.
Gap analysis
Quarterly compliance gap analysis with action plan.
Policy library
Ready-to-adopt and customizable policy templates.
ANSSI Declaration
Pre-filled forms for 24h/72h incident declarations.
Board reports
Governance-oriented summaries for your executive bodies.
Risk register
Dynamic register with scoring and treatment plan.
Supply chain
Cyber assessment of your critical suppliers.
Exclusive IoC feeds
Indicators of compromise updated every 15 minutes.
APT actor profiles
Detailed profiles of groups targeting your sector.
Campaign tracking
Active campaign tracking by sector and geography.
TLP management
Strict adherence to Traffic Light Protocol classifications.
Credential monitoring
Immediate alert if a company password leaks.
Brand monitoring
Detection of brand mentions on underground forums.
Data leaks
Early identification of exposed databases related to you.
Real-time alerts
Notification within minutes of detecting an exposure.
Slack / Teams / Discord
Native notifications and response commands from your channels.
Microsoft 365 / Google
Authentication and messaging log ingestion.
Active Directory / LDAP
User synchronization and anomaly detection.
Firewalls
Fortinet, Palo Alto, Checkpoint, pfSense, Stormshield connectors.
Third-party SIEM
Export to Splunk, Elastic, QRadar if you keep an existing SIEM.
Custom webhooks
Trigger any external workflow on events.
Complete REST API
Everything visible in the console is accessible via API.
SSO SAML / OIDC
Unified authentication with your existing IDP.
64 features.
One decision.
Start a 14-day trial. No credit card. Everything activated by default.