Review · Logged September 2026

Nebulock review: agentic threat hunting with a published hypothesis framework

Autonomous and hypothesis-driven hunts, federated search and retrohunt-tested detections.

#1=7.45 / 10Joint top pick: hypothesis-driven hunting with open frameworks

Editorial assessment · From vendor product pages, docs and announcements · Updated 2026-10-22

What does Nebulock do?

Nebulock describes its product as an Agentic Cybersecurity Engineering (ACE) platform to hunt, detect, investigate and triage activity.

Hunting runs two ways. An agent Nebulock calls Vespyr 'hunts without a directive, turning a threat intel report into a deployable detection in minutes.' Analyst-led hunts follow the LOCK framework: Learn (start with a hypothesis and map it to MITRE ATT&CK), Observe (establish baselines), Check (test the hypothesis) and Keep (close with a finding). A component called Helix uses federated search 'to get data just-in-time, not just-in-case.'

Detections can be edited in chat or directly in SQL and exported to GitHub. Every save creates a new version that can be compared and reverted, and 'every detection rule must pass a Retrohunt before deployment', a test against past telemetry.

Nebulock also publishes two open-source projects under the MIT license: the Agentic Threat Hunting Framework (ATHF) and an Agentic Detection Engineering Framework.

Key facts

Key facts about Nebulock
Category	Agentic cybersecurity engineering platform
Hunting approach	Autonomous hunts from intelligence (Vespyr) and hypothesis-driven hunts (LOCK framework)
Data access	Federated search (Helix), data fetched when a hunt needs it
Platforms named publicly	Okta, Microsoft Entra, Duo, CrowdStrike, Microsoft Defender, SentinelOne, AWS CloudTrail, Microsoft Event Hub, Microsoft Sentinel, Jamf; Slack, Microsoft Teams, Tines, Jira, GitHub
ATT&CK claim	Hypotheses mapped to ATT&CK; docs name credential theft, privilege escalation and lateral movement
Detection workflow	Chat or SQL editing, immutable version history, GitHub export, required retrohunt before deployment
Deployment	SaaS
Pricing	Not published
Company	Open-source ATHF and detection engineering framework on GitHub (MIT)

Source: nebulock.io · nebulock.io/platform · Read 2026-10-22 · docs.nebulock.io · docs.nebulock.io/docs/detection-engineering · github.com/Nebulock-Inc · Source dates shown above

Last reviewed 2026-10-22

How does Nebulock score?

7.45 / 10

Hunt automation

25%9 / 10

Autonomous hunts from intelligence plus a published four-stage hypothesis framework (LOCK).

Joint highest in field

Works across existing SIEM and data lakes

20%8 / 10

Federated search fetches data just in time; docs name EDR, identity, cloud and Microsoft Sentinel integrations.

Analyst effort saved

15%8 / 10

Agents cover intelligence, hunt, investigation and detection; retrohunts reduce tuning work.

ATT&CK coverage evidence

10%7 / 10

Hypotheses map to ATT&CK and docs name credential theft, privilege escalation and lateral movement; no full public map.

Detection-as-code workflow

10%8 / 10

Immutable version history with compare and revert, GitHub export, and a required retrohunt before deployment.

Deployment

10%7 / 10

SaaS with documented integrations; no published time-to-value figure.

Pricing transparency

10%2 / 10

No public price.

Where Nebulock scores lower

Deployment (7 of 10): SaaS with documented integrations, but no published time to first value. Mars (9) states deployment in hours.
Works across existing data (8 of 10): federated, but the published integration list centers on endpoint, identity and cloud; data lakes such as Snowflake or Databricks are not listed in the docs we read. Mars and Anvilogic score 9.
ATT&CK coverage evidence (7 of 10): names three tactics but publishes no full coverage map.
Pricing transparency (2 of 10): no public price.

What does Nebulock publish about ATT&CK coverage?

Nebulock is the only vendor whose public docs name specific tactics: Privilege Escalation, Credential Access and Lateral Movement. Its LOCK framework maps hypotheses to ATT&CK.

Who should shortlist Nebulock?

Good fit if

You want both autonomous hunts and a structured method for analyst-led hunts.
Your priority threats are identity and endpoint: credential theft, privilege escalation, lateral movement.
You want detections versioned and tested against past data before they deploy.

Look elsewhere if

Your hunting data lives mainly in a data lake (check integrations first; Mars and Anvilogic name Snowflake and Databricks).

How does Nebulock compare?

Frequently asked questions

What is the LOCK framework?

Nebulock's four-stage hunting structure: Learn (start with a hypothesis and map it to ATT&CK), Observe (establish baselines), Check (test the hypothesis) and Keep (close with a finding).

Is Nebulock open source?

The platform is SaaS. Nebulock publishes its Agentic Threat Hunting Framework and an Agentic Detection Engineering Framework on GitHub under the MIT license.

What is a retrohunt?

Running a detection against past telemetry to see what it would have found. Nebulock requires every rule to pass one before deployment.

Visit nebulock.io