Detection as Code

SOC Prime's news page lists five posts under one date

Dated 2026-11-03. Checked 2026-11-04.

SOC Prime's news page listed five posts under the date 2026-11-03 when we read it: detection write-ups for Node2Shell and HTTP2Shell, a Kimsuky detection and exploitation analysis, a PHP2Shell detection, and log export guides for SentinelOne Singularity Data Lake and Falcon LogScale.

All five carry the same listed date, which is probably the page's update date, so we do not treat it as the day each post was written. The listing names no product release. It gives titles only, so it shows what the library publishes, not how many rules it holds.

Source: socprime.com read 2026-11-04

What it changes for a buyer

Nothing in the workflow changes. The page is content marketing, and the library size and the daily cadence on the marketplace page remain vendor claims with no dates.

Where this stands on the rubric

Current rubric standing of the platforms this note names.

PlatformTotal, of 10Matrix, of 33Rule health, of 5
SOC Prime5.115.00.0

All notes are in the changelog. Spotted something wrong? See corrections.