Enriched

Access to 0-hour rulesets and large language models tuned for malware analysis, bundled with direct support for Scan, Isomer, and Cleave.

Get Enriched → View open-source Scan

Rules

Subscription

Incident-speed detection.

When a supply-chain incident is disclosed, the atomdrift team provides updated Scan and Cleave detection assets to Enriched subscribers around the clock. Isomer subscribers also get the latest differential detection work as it develops.

Premium rule sets go beyond the upstream release: higher-fidelity signatures, platform-specific variants, and rules for threat patterns we're tracking but haven't fully validated for general release.

  • Immediate rule delivery on incident disclosure
  • Premium signatures not in the upstream release
  • Platform-specific rule variants
  • Early access to experimental detection patterns

Support

Included

Direct line to the engineers who built it.

Enriched includes SLA-backed technical support for the atomdrift portfolio. You're not talking to a support tier — you're talking to the people writing the code. Priority issue resolution, security patches, integration guidance, and version upgrade support.

  • SLA-backed response times for atomdrift portfolio technical issues
  • Priority security patches and version upgrades
  • Integration guidance for your deployment environment or product roadmap
  • Direct access to the engineers building atomdrift, not a support queue

Pricing

Monthly

Snort-style feed licensing.

We're not quite ready to accept your money yet — but here's our plan, in the interest of transparency. Every tier will include 0-hour ruleset updates and support for the atomdrift portfolio.

Community $19/mo

For personal, non-profit, and education use.

Business $399/mo

For internal commercial use by your team or organization.

OEM / Integration $999/mo

Allows scanning customer workloads and includes rule/model redistribution rights.

The upstream relationship

Commercial subscribers fund the open-source release.

Enriched revenue directly funds the engineers who maintain Scan, Isomer, and Cleave. Subscribers get detection updates around the clock, while the open-source community gets the same work upstream.

Ready to get Enriched?

Pick the feed license that matches your use case. Email us and we'll get you set up.