90 days, full capability, no signup.
# Shannon entropy over every proxy destination. Four lines. index=proxy | stats sum(bytes_out) as bytes_out by dest_host | exec inline="import math for e in events: h = e['dest_host'] counts = {} for ch in h: counts[ch] = counts.get(ch, 0) + 1 entropy = -sum((c/len(h)) * math.log2(c/len(h)) for c in counts.values()) e['verdict'] = 'suspicious' if entropy > 3.6 else 'ordinary'"
Try that in eval.
BabySOARus has no telemetry. It does not phone home when it starts, when it runs a search, or when it checks its licence. Your data, your detections and the code you write stay inside your deployment.
We cannot see them, and we could not obtain them if we wanted to.
Licence verification is an offline signature check that reaches nothing. Stated in section 1 of our Privacy Policy.
When a licence expires, your searches keep running and your data stays reachable. Outbound network access from your code is denied, and that is all. Nothing is deleted, hidden or locked.
We are contractually bound to this.
Section 6.3 of the licence agreement commits us not to make expiry behaviour more restrictive for a term already bought.
$12,000 per year, per Splunk deployment. Unlimited users. Unlimited executions. A search head cluster is one deployment however many members it has.
Splunk SOAR is priced per analyst seat and has no published price anywhere.
Every figure you have seen quoted for SOAR is a third-party estimate. Ours is on the pricing page.
No signup, no key, no email address.
Not a reduced edition or a feature-gated preview. Every library detection, the editor, background work, outbound HTTP, all of it. Install from Splunkbase and start.
The clock runs locally, inside your own Splunk. Nothing registers you anywhere, because there is nothing to register with.
| A SOAR platform | BabySOARus | |
|---|---|---|
| Where it runs | Its own platform, alongside Splunk | Inside Splunk, as an app |
| Data movement | Your events, exported to it | None. Nothing leaves. |
| Writing logic | A visual playbook editor | Python, in the search bar |
| Time to first detection | A project | A search |
| Pricing | Per analyst seat, unpublished | Per deployment, published |
| On expiry | Ask your account manager | Searches keep running |
eval
Loops, dictionaries, math, json, re,
datetime, and the standard library you already know. The things
eval was never meant to express become four readable lines.
Enrich against threat intel, look up an asset owner, open a ticket. Requests are made once per batch rather than once per event, which is the difference between one API call and five hundred.
Password spray, impossible travel, DNS tunnelling, beaconing by inter-arrival jitter, exfiltration by domain entropy, and twenty-five more. Every one is a starting point to adapt, not a black box to trust.
A persistent daemon keeps a pool of warm interpreters. Everything we add around your code is measured in microseconds rather than milliseconds, so the interesting cost is the logic you wrote.
Guest code has no sockets and no filesystem beyond the lookup directories you give it. Outbound HTTP passes through a network policy that is configuration rather than code, so what a function may reach is your decision.
Functions are files. Version them, review them, test them with captured fixtures, and promote them between environments with the same tools you use for everything else.
Ninety days at full capability. Nothing to sign up for.