0x13d::att&ck
Browser EDR · MITRE ATT&CK · Go-to-Market

The product is trust, delivered as coverage.

Host EDR is blind to what happens inside the browser. 0x13d::att&ck watches from the inside, matches browser events to MITRE ATT&CK, and — uniquely — proves its own trustworthiness: fully auditable, zero telemetry, enforced by the build itself.

▶ See the 5-minute demo Open-core model
16 → 25techniques · free tier → premium
$10/user/yr~1/6 of the heavy-SaaS incumbents
0 telemetry · host perms in the free tier
01

The wedge

A host agent sits outside the browser and can't see the modern initial-access surface that lives inside it — rogue extensions, OAuth consent phishing, lookalike logins, session-cookie theft, DLP/GenAI exfil. Four things make this a wedge, not a me-too.

01 · lean

Fully auditable

Zero-dependency service worker, declarative rules (never eval), no telemetry. The free tier's trust posture is mechanically enforced — the build fails if the bundle gains a fetch( or a host permission.

02 · fits

Your devops, your SIEM

Self-host the open build, author rules as data, ship detections to your SIEM. No platform to adopt, no data leaving your control.

03 · anchored

MITRE-native

Coverage is expressed as ATT&CK techniques, so a buyer maps it onto their existing threat model in seconds.

04 · priced

Lands as a line-item

$10/user/yr — small enough to be an MSP line-item for the 10–50-person SMBs the heavy SaaS incumbents ignore. No known open-source BDR/XDR competitor.

02

The SaaS shape

We deliver the premium tier the way the AWS SaaS reference model frames it — a shared control plane and a per-tenant application plane. Every box below is a real component, not an aspiration.

◆ Control plane — elsa-broker
Onboarding & identity
CertTools + ClientAllowlist.json · mTLS cert → ClientId
Tiering & entitlement
per-client bundles[] → elsabroker:bundle claims
Rule distribution
GET /bundles/*/latest · ETag / 304
Detection-event ingest
POST /requests → RequestRecord (durable)
Observability
Switchboard · BundleFetched / RequestSubmitted
pull tuned bundle
←
ship DetectionEvent
→
mTLS only
◇ Application plane — tenant fleets
Community tenant 16
att&ck MV3 ext · zero host perms · no egress · local alert only
Enterprise tenant 25
managed policy · scoped host + egress · pulls tuned rules · ships detections
Detection runs locally in every tenant. The premium value is the tuning, delivered — not secret rules.
diagram 01 · control-plane / application-plane overview · source: docs/diagrams/01-saas-two-plane.mmd
03

Open-core, with the moat in the free tier

The boundary between tiers is drawn at host access and log egress — the exact line the trust story depends on. The free edition isn't a crippled demo; it's the trust flagship and the top of the funnel.

Community · free

The trust flagship

AGPL-3.0 · fully functional · lead-gen
  • ●16 techniques (Buckets A+B)
  • ●Zero host permissions — none, ever
  • ●Zero network egress — SIEM sink removed; local alert only
  • ●Enforced by the build — a fetch( or host perm fails it
  • ●AGPL copyleft — a closed-SaaS rival can't fork it closed
Enterprise · $10/user/yr

The full 25, tuned

commercial license · undercuts SquareX ~$60
  • ▲25 techniques (+9 Bucket-C: DLP/GenAI exfil, AiTM, C2…)
  • ▲Scoped host access — opt-in, declared, never <all_urls>
  • ▲SIEM/LME egress + webRequest + content-script
  • ▲Gated by managed policy — off until the org turns it on
  • ▲Tuned nightly — delivered over mTLS from the broker
Trust boundary — host + egress
diagram 02 · tiering · source: docs/diagrams/02-tiering.mmd · same engine, same schema — mix and match, no lock-in
04

Coverage that improves on its own

The 25 rules are code; what a customer pays for is the continuously-tuned policy — IOC feeds, allowlists, thresholds — refined against real detection corpora and delivered as versioned bundles. It's a recurring value that compounds.

tune
tuning/*.json
IOC feeds · allowlists · thresholds
build
build-bundles.mjs
policy + technique manifest + sha256
release
release-nightly.mjs
<base>-nightly.<date>
distribute
/bundles/*/latest
mTLS · entitled tenants only
detect
tenant fleet
att&ck extension · 25 techniques
diagram 04 · rule lifecycle + feedback loop · source: docs/diagrams/04-rule-lifecycle.mmd
05

The buyer journey

The free edition does the selling. Onboarding to paid is a cert and an allowlist entry — no rip-and-replace.

01discover

Audit the free build

A security engineer finds the open Community edition and inspects it — that's the point — loads it, and sees real detections locally. Trust is earned by reading the code, not asserted in a datasheet.

02outgrow

Hit the coverage ceiling

They need DLP/GenAI exfil (T1567), AiTM (T1557), C2 detection — all Bucket-C, all of which inherently require network or page observation.

03onboard

Issue a cert, entitle a bundle

We mint an mTLS client cert and add an allowlist entry granting the enterprise bundle. Their fleet pulls the tuned 25-technique ruleset — under their managed policy, scoped to their hosts, shipping to their SIEM.

04expand

MSP resale & wider scope

MSPs resell it per-seat across their SMB book; enterprises widen host scope and opt into detection-event sharing — better tuning for them, a richer corpus for everyone.

diagram 03 · onboarding sequence · source: docs/diagrams/03-onboarding.mmd
06

The demo is the diagrams, executed

One command spins up the whole control plane and proves the story end-to-end. The demo client runs actual detection code — not a mock — ships a real detection over mTLS, and the dashboard shows the receipt live.

sales/up.sh — end-to-end detection → broker receipt
# one command — the broker control plane comes up (SQL · Elsa · Queue · Processor · Switchboard)
$ ./sales/up.sh
[compose] queue healthy  processor healthy  switchboard healthy

# the demo client runs a REAL detection function against a benign payload
[demo-client] assess() → Hit  technique=T1539  rule=session-cookie-weak-flags
[demo-client] POST /requests  (mTLS, DetectionEvent)     → 202 Accepted  cid=7f3a…c1
[demo-client] GET  /requests/7f3a…c1                       → stored  (ownership-scoped)
[demo-client] GET  /bundles/attack-rules-enterprise/latest → 200  X-Bundle-Version=0.1.0  rules=25

# receipt is live on the dashboard
✓ Switchboard http://localhost:5002 → RequestSubmitted · BundleFetched

Not entitled to a bundle? You get a 404, indistinguishable from one that doesn't exist — entitlement isn't probeable. The live-browser variant (headless Chrome + the real extension) is documented for SEs who want maximum fidelity. You don't have to trust us — you can watch it, and read every line.

diagram 05 · demo topology · source: docs/diagrams/05-demo-topology.mmd · env: _community/elsa/broker/sales/
07

Backed by real engineering

Every claim on this page is anchored in code a prospect can read or run. That's not a footnote — it's the product.

ClaimProof you can open
Zero egress in the free tier, enforcedapps/extension/build.mjs — self-check fails on fetch( / host perm
25 techniques, real rules + testsrules-enterprise/ — 63 tests · buildFullRuleset() = 16 + 9
Tuned rules delivered as a servicescripts/build-bundles.mjs · release-nightly.mjs · tuning/
mTLS, tiered distributionbroker BundleEndpoints + ClientAllowlist.json bundles[] · ADR-0010
Detection telemetry — opt-in, durablebroker DetectionEvent workflow → RequestRecord
Runnable proof_community/elsa/broker/sales/ — one-command demo

16 techniques, zero host permissions, no egress, fully auditable — free. 25 techniques, tuned nightly over mTLS under your managed policy — $10/user/yr. One-sixth the price, one hundred percent inspectable.

0x13d::att&ck · 0x13d.app · Browser Endpoint Detection & Response