Membership

The research is free.Membership is the working material.

The whole Threat Wire is free, and so is most of the archive. Permanently, not as a trial, and nothing that is free today gets moved behind a wall later.

Membership buys what sits behind it: the artifact reference you keep open during a case, the desk, the labs whose answers are checked, and the reading room. The exact figures are counted from the database further down this page.

Free

Anyone

Free

Everything we publish, and the whole Threat Wire. No account needed to read it.

Every write-up published as public, in full, a little over half the archive
The whole Threat Wire, refreshed every six hours, forever
The execution-evidence entries in the artifact reference
The learning path, the free labs, and progress tracking
The community, and posting in it
Weekly Artifact Briefing by email

Browse the archive

Your current plan

Pro

Analysts, DFIR practitioners, students

€9/mo€15/mo

Founding rate

The reference you keep open during a case, and the labs that make you quicker at it.

Everything in Free
The complete artifact reference, file system, persistence, authentication and resource use
Every entry searchable by path and by ATT&CK technique
The members-only teardowns and labs
Detection rules with tuning notes on every rule
The full IOC list on a post, where the public page shows a sample
7-day trial, no card taken up front

Pro+

Consultants, sole practitioners, one-person security teams

€19/mo€29/mo

Founding rate

Everything a team seat reaches, for one person. The rule packs and the export API without buying two seats you will not fill.

Everything in Pro
The raw detection-rule packs, in the formats they are published in
Threat Wire export in JSON, CSV and STIX 2.1
A scoped, revocable API key for your own tooling
One seat, no minimum, no seat admin to do

Team

Corporate security teams, MSSPs, consultancies

€29/seat/mo€45/seat/mo

Founding rate

Minimum 3 seats, so from €87/mo

The same, for everyone on the team, plus the parts your tooling can call.

Everything in Pro, for every seat
Seat management from 3 seats up
The raw detection-rule packs, in the formats they are published in
Threat Wire export, JSON, CSV and STIX 2.1
Scoped, revocable API keys for your own tooling
One invoice, and a record of who had access when
Card taken at checkout, nothing charged until the 7-day trial ends

Counted today

What is actually in there

Every figure here is a count taken from the database as this page loaded, not a number typed into the copy above. The archive is young and these are small; you should know that before paying rather than after.

write-ups free to read: 23 / 3510 of them guided labs · 12 behind the membership
artifact reference entries free: 10 / 3626 behind the membership
Threat Wire entries: 3,342all free, refreshed every six hours
carry an analyst assessment: 0none written yet, and not sold as though there were

Downloadable rule packs are published in Sigma, Snort and YARA. Formats not on that list are not in the catalogue, whatever a plan elsewhere might once have implied. How any of it is produced.

Expense it

Convince your boss

Most people who want this have a corporate card and no appetite for writing the justification. Here it is, written. Change what is wrong about your team and send it.

Subject: Subscription request: Security Artifacts (DFIR reference and detection rules)

Hi,

I would like to expense a subscription to Security Artifacts, a DFIR reference and detection-engineering publication. It is €9/mo for an individual licence, or €29/seat/mo with a minimum of 3 seats for the team plan.

What it gives us:

- Detection rule packs (Sigma, YARA, Snort) released under CC0, so we can deploy them into our SIEM, modify them, and keep them with no licence review. Each rule ships with measured false-positive notes, which is the part that usually costs us a week of tuning.
- First-hour incident playbooks and one-page triage sheets covering the collection order for Windows, Active Directory and cloud identity cases. These reduce the time between "something is wrong" and "we know what to collect", which is where most of our MTTR actually goes.
- An artifact reference with hunting queries in Splunk SPL, Sentinel KQL and Elastic EQL, so a question about what an artifact proves does not become an afternoon of research.
- A threat wire tracking CISA KEV additions with their federal remediation deadlines, which is directly useful for our own patch prioritisation.

Everything published is verified on an isolated analysis machine before release rather than summarised from vendor reporting, which is the reason I am asking for this one specifically rather than a general research budget.

The team plan also gives us centralised billing, seat management, and API access for pulling the threat feed into our own tooling.

Happy to trial it first and report back on whether it earns its place.

Thanks,

Open in my email client

the fine print, in plain words

The trial: 7 days on every plan. Pro and Pro+ collect no card up front; Team asks for one at checkout, because a team is billed by invoice. Either way nothing is charged until the trial ends, and if no card is on file when it does, the subscription cancels itself. There is no charge to dispute and nothing to cancel.
Cancelling: One button in your account, effective at the end of the period you have already paid for. No email, no retention call.
The detection rules: CC0, on every tier including free. Take them, change them, ship them in a commercial product, no attribution required. A rule with a licence attached is a rule nobody deploys.
What we publish: Lab work, or public cases reconstructed from public evidence. Never client data. Cases written for practice are labelled as constructed on the article itself, not only here.
Payment: Cards, Apple Pay and Google Pay wherever Stripe supports them. Klarna on Pro where it is available; Klarna does not permit business purchases, so it is not offered on Team. Card details are entered on Stripe’s own page and never reach this site.