Skip to main content
Wirespeed stores events from your integrations in its SIEM and normalizes key activity for cross-source investigation.

​
Event views

  • Explore searches SIEM 2.0 vendor and normalized tables with Wirespeed Expression Language (WEL).
  • Advanced runs SQL for manual analysis and exports.
  • Legacy remains available for teams with retained OCSF events.
Create custom detections with Ask Wirespeed, not from Advanced. The assistant inspects your connected schema, builds a source-aware WHERE predicate, executes it under the production limits, and shows the match count before you confirm. Some ingested events are tagged as productivity activity, including mailbox and related collaboration actions. These normalized events remain available for investigation in Explore.