SOC Prime

SOC Prime scores 5.11 of 10, ninth of the 12 profiled, 0.15 behind Detecteam. It sells a commercial detection library and conversion tools built around Sigma. Library size and language counts are vendor claims that differ between pages, and its docs host did not resolve in the scoring session, so git, CI and versioning score low.

Rubric total

5.11 of 10, ninth of 14 scored, ninth of 12 profiled

Matrix score

5.0 of 33 (0 documented, 10 partial, 23 not documented)

Rule health

0 documented, 0 partial of 5 matrix rule-health columns

Ownership

Independent company. No acquisition or rebrand found in the vendor's blog and news pages (read 2026-11-03) or in one news search. The search surfaced a 2026 reseller deal with NPCORE in South Korea (a distribution agreement, not an ownership change) and a 2025 funding round listed by aggregators. socprime.com read 2026-11-03

Website

socprime.com

What SOC Prime is

SOC Prime sells a commercial detection library, the Threat Detection Marketplace, and tools to deploy and convert rules: Prime Detect, Prime Architect, Uncoder AI and the open-source Uncoder.IO converter (vendor claims, read 2026-11-03). Its pages treat Sigma as the source format. Prime Architect converts Sigma into 48 SIEM and platform languages and Prime Detect applies Sigma rules to streaming events.

Plans are quote only. docs.socprime.com did not resolve in the scoring session, so the git, CI and versioning cells rest on product pages and score low for that reason. They are re-read at the next refresh on 2027-02-03. The pages also give three different library sizes, listed below.

Vendor description: SOC Prime sells a commercial threat detection rule library (the Threat Detection Marketplace) and tools to deploy, convert and hunt with those rules: Prime Hunt, Prime Detect, LogTotal and the open-source Uncoder.IO converter. Pricing is quote-based. Its own site says the library has 750,000+ detection rules and 28 vendor integrations. socprime.com read 2026-11-03 vendor claim

How SOC Prime scores on the rubric

5.11 of 10 across eight weighted criteria. Each score has its reason and the page it was read from. The rubric explains the bands.

SOC Prime on the eight rubric criteria. Part = weight times score over 100; the parts sum to the total.

The 33 capabilities for SOC Prime

documentedpartialnot documented

Notes and sources for each cell are on the group pages: Languages, Source control and CI, Testing, Coverage analytics, Rule health, Library.

Where SOC Prime is strong

• The Uncoder AI page states 48 targets for Sigma conversion, 21 for direct translation and 65 for query optimisation, but does not name them (vendor claim). Conversion breadth is its core pitch. socprime.com read 2026-11-04
• The marketplace page says 50+ rules are added every day (vendor claim), a daily cadence, though the figure carries no date or method. socprime.com read 2026-11-03
• The marketplace lists SOC Coverage, which tracks ATT&CK technique and log source coverage, and a MITRE ATT&CK Audit service (vendor claims). No gap view is shown. socprime.com read 2026-11-03

Where SOC Prime is behind

• Library size is stated as 750,000+ rules on the marketplace page, 1,000,000+ on the platform page and 20,000+ for Prime Detect. None of the figures is dated. socprime.com read 2026-11-03
• No git sync, CLI or pipeline steps could be read. The platform page lists adapt CI/CD workflows as a benefit and shows none. socprime.com read 2026-11-03
• No noisy-rule, broken-rule, field drift or performance feature appears on the pages read, though marketing copy calls the rules low-noise. socprime.com read 2026-11-03

What only SOC Prime publishes

Prime Detect accepts EVTX, CEF, JSON or NDJSON and syslog, and names Kafka, Flink, Cribl and Vector as pipeline options (vendor claim). socprime.com read 2026-11-03

Pricing as published for SOC Prime

Quote only. The FAQ on the Threat Detection Marketplace page says plans depend on the customer's request and to contact sales for a quote, and no public price tiers are published on the pricing page or the marketplace page, so the tiers the user asked about are not public. socprime.com read 2026-11-03

Named customers of SOC Prime

Names below are as the source page lists them.

Customers named on public pages. Every name is a vendor claim from the page cited in its row.

Recent releases and news for SOC Prime

• 2026-11-03 Blog: Node2Shell/HTTP2Shell detection; Kimsuky detection and exploitation analysis; PHP2Shell detection; SentinelOne Singularity Data Lake log export; Falcon LogScale log export. Five blog posts listed on the news page, all with the same listed date. The date is probably a page update date, and no product release is named. socprime.com read 2026-11-03 vendor claim
• 2026-03-12 DetectFlow Enterprise for real-time threat detection. Product launch as listed on an aggregator profile. Not confirmed on an SOC Prime page. caplight.com read 2026-11-03 vendor claim
• 2026-02-09 NPCORE named exclusive reseller of SOC Prime in South Korea. Distribution agreement announced by NPCORE, signed November 2025 and effective February 2026. A reseller deal, not an acquisition. digitaltoday.co.kr read 2026-11-03

Claims SOC Prime makes about itself

Each figure is the vendor's. The evidence grade is defined on the rubric page: A measured by a third party with the method published, B vendor-measured with sample and method, C vendor figure with no method, D figure with no source.

Vendor claims with the evidence grade and who measured.

Shortlist SOC Prime when

• You want to buy a rule feed with a stated daily cadence and convert it for several SIEMs.
• You need Sigma translated into a language your SIEM runs and can live with vendor claims on counts.
• You will test the library in a proof of concept, since no replay or backtest method is published.

Verdict on SOC Prime

Ninth of 12 at 5.11, in no band, 0.15 behind Detecteam, held down by unreadable git docs and no documented rule health.

Compare SOC Prime

Alternatives to SOC Prime. Head-to-head diffs: Anvilogic, Panther, Sigma and pySigma, Detecteam, Elastic Security, Splunk Enterprise Security (Cisco), Sekoia.io, Hunters, Google Security Operations, Microsoft Sentinel, Mate Security.