SaaS ideas your next customers are already looking for
100 SaaS startup ideas for the people who said they'd pay, from agency owners to dentists. Micro SaaS ideas, AI SaaS ideas and B2B SaaS ideas: find yours, build it, sign them up.
Popular:
| # | Idea |
|---|
No idea matches this filter.
Pain points in business: what people struggle with
Search the problems to solve, as people described them on Reddit and other platforms, in their own words.
Popular:
| # | Pain point |
|---|
No pain point matches this filter.
SIEM Detection Rule Gaps
Security teams struggle to build, validate, and maintain SIEM detection rules that reliably catch real attacks, leaving blind spots and manual toil.
In their words
The licensing is one thing but honestly the bigger issue is engineering time. Tuning detections, managing integrations, keeping rules updated.
I want a provider that will isolate a host, disable an account, or revoke sessions at 3am under runbooks we've approved ahead of time.
How many feeds are you paying for versus how many have actually changed a prioritization decision you would not have made otherwise.
It seems like writing detections for ES and maintaining Splunk are two full time jobs for basically any org that's using Splunk even at a small scale.
How do you measure the ROI of a platform that prevents breaches versus one that just finds vulnerabilities?
If the intel never makes it to the SIEM, what's the actual value?
It was a Fake Captcha/ClickFix scam that tricked the user into running a malicious powershell command.
I'm looking to integrate Claude Code with Microsoft 365 and Microsoft Defender (Defender XDR / Sentinel) to assist with threat hunting, incident investigation, and EDR analysis.
How much effort am I looking at to build up our rules for detections and other security alerts?
Right now we write a detection, send it into the SIEM, and then trust it until an incident proves otherwise.
While the team is extracting indicators, writing rules, and tuning alert thresholds, the underlying campaign or threat actor may still be active in the environment.
the incident comes through exactly the gap the architect knew about at design time - but nobody prepared telemetry or a detection for it
SOC and detection engineers
Where they talk
- r/cybersecurity
- r/AskNetsec
- r/blueteamsec
- r/sysadmin
- r/crowdstrike
- r/threatintel
- r/ciso
- r/Splunk
Tools they use today
- Splunk
- Defender
- CrowdStrike
- Sentinel
- SOAR
- Wazuh
- Sigma
- CrowdStrike Falcon
Why those fall short
- case management poor, hard to integrate other sources
- EDR is reactive; DefensX miscategorized the site as low risk
- no built-in behavioral detection; no documentation of defaults to avoid duplication
- demos all look the same, can't tell real from polished
- no one watching; on-call response can take up to an hour
Map of ideas
Drawing the map…