Ingest
Endpoint, identity and firewall telemetry streams in over an encrypted channel. Windows Sysmon, Linux auditd, Microsoft 365 and perimeter firewalls are supported today.
DetectMonkey by Codein · Canada
Detect threats in seconds. Your data stays in Canada.
DetectMonkey watches your endpoints, identities and firewalls in real time and alerts your team the moment something hostile happens. Made, hosted, and operated in Canada by Codein. No SIEM project, no per-gigabyte bill. Bilingual analysts are available when you want them.
Reference trace — sample events
Detection pipeline
Representative events from the detection pipeline. Early-access accounts see their own telemetry live.
Seconds
Typical time from event to alertEvent to alert
Canada
Telemetry processed and stored on private
serversStored in Canada
$150
CAD per month · up to 10 seats includedPer month
Optional
Bilingual analyst coverage, 8am–8pm ASTAnalyst coverage, 8am–8pm
Processed and stored on private servers in Canada
Flat monthly pricing, no per-gigabyte fees
Bilingual analysts in Canada
Alerts in seconds, not the next morning
01 What DetectMonkey does
Detection and alerting. Nothing you didn't ask for.
DetectMonkey reads your telemetry, matches it against detection rules and attack patterns as it arrives, and tells your team what happened. By default, it does not change, isolate or block anything on your systems — that stays your call.
Detect
Events are matched in-stream against detection rules and multi-step attack patterns. A single suspicious event and a slow, multi-stage intrusion are both caught as they happen.
Alert
Your team gets the alert with the evidence attached: what happened, on which asset, and the events behind it. Delivery to email, Slack or a webhook is set up with you during onboarding.
Investigate
Follow the alert back through 72 hours of telemetry: which host, which identity, what came before it. No archive rehydration, no waiting for an index to rebuild.
02 Anatomy of an alert
What you actually receive
Four common patterns and the alerts they produce. What matters is the evidence attached and who gets told.
Event → Detection → Alert
Representative sequence for a mid-market Windows environment.
Illustrative sequence. Your alert content depends on your onboarding.
03 Pricing
Simple pricing. No per-gigabyte tax.
Monitoring is a flat monthly price covering up to 10 monitored seats. Analyst triage and incident response are available add-ons. All in Canadian dollars.
Monitoring
Detection and alerting
Automated threat detection and alerting for your endpoints, identities and firewalls.
$150CAD / month
- Endpoint, identity and firewall telemetry
- Real-time detection and alerting
- 72-hour investigation window
- Delivery set up during onboarding (email, Slack or webhook)
- Data processed and stored in Canada
Up to 10 monitored seats included · 90 days free for early access
Analyst response
People in the loop
Bilingual analysts review what the platform finds and tell your team what to do next.
$1,000CAD / month
- Everything in Monitoring
- Bilingual analyst review and triage (EN / FR)
- Coverage 8am–8pm AST, Monday to Friday
- Triage notes and recommended next steps
- Response target and after-hours terms scoped per engagement
Added to your Monitoring subscription
Incident response
Active intervention
Hands-on containment, breach isolation and rapid response when an incident strikes.
CustomCAD / retainer
- Everything in Analyst Response
- Hands-on threat containment and process termination
- Host isolation and credential revocation coordination
- Incident commander bridge and emergency war room
- Digital forensics, root-cause report (RCA) and debrief
Retainer scoped to your environment
04 Why flat pricing
What per-gigabyte billing does to a security budget
Classic SIEMs charge for volume, so teams turn off the high-value logs — DNS, firewall, Sysmon — to control the bill. That is where intrusions hide.
DNS, firewall connection logs, Windows Sysmon and cloud audit trails.
Laptops, workstations, servers and cloud identities. Up to 10 monitored seats are included in the $150/month plan — the price does not change with the seat count.
- Per-GB SIEM estimate (illustrative)
- $14,250 / mo
- DetectMonkey Monitoring, flat monthly
- $150 / mo
$169,200 / yr
Illustrative difference, annualized
Illustrative only: assumes $4.25/GB/day plus a $1,500 monthly platform fee. Your SIEM quote will differ.
05 Early access
The first ten organizations help set the defaults
Codein is early. Early access is how we get detection thresholds right on real networks — and how you find out what fast alerting changes about your week.
01
90 days, no charge
Monitoring for up to 100 seats for 90 days. No card, no auto-conversion. When the pilot ends, you decide whether to keep going.
02
Founder-led onboarding
We wire the collectors with you, set your alert delivery, and tune the first rules against your own traffic. You get a direct line, not a ticket queue.
03
Say what you think
Early access exists to be argued with. Tell us what is noisy, what is missing and what you would pay for. Case studies are opt-in, always.
06 Canada
Made, hosted, and operated in Canada.
Codein is a Canadian company. Detection, alerting, and analyst coverage run entirely within Canada, in English and French — for organizations across the country.
01
Canadian by design
Made, hosted, and operated in Canada, onboarding organizations across the country. The people who wire your collectors are in Canada.
02
Bilingual coverage
Alerts and analyst triage in English or French, from a team that works in both official languages every day.
03
Sized for Canadian teams
From three seats up, one flat $150 a month. No SIEM project and no per-gigabyte bill — a price an IT budget can actually approve.
Made, hosted, and operated in Canada
● Free guide
The Security Operations Glossary
107 plain-language entries — EDR, NDR, ITDR, SIEM, XDR, MDR and the rest — plus a one-page map of where each tool stops and the next begins. 63 pages, written for the person who has to buy, run or explain this.
07 Questions & answers
Frequently asked questions
Straight answers about what DetectMonkey does, where your data lives, and what happens when an alert fires.
01What happens when DetectMonkey detects a threat?
You get an alert with the evidence attached: the event, the asset, the identity, and the rule or pattern
that matched. DetectMonkey does not change, isolate or block anything on your systems. Your team decides what to
do — or engages Analyst Response and a bilingual analyst walks through the next step with you.
02How fast is detection, really?
Alerts typically arrive within seconds of the event. The exact figure depends on your telemetry, your
network path and the rule that fires, so we measure it with you during onboarding rather than quote a
number that only holds on our test bench.
03Where is my telemetry stored?
Telemetry is processed and stored on private servers we operate in Canada — not in a public cloud, and not
shipped to a US-based platform. You are not billed per gigabyte either, so there is no incentive to drop
the noisy logs that matter most.
04Which telemetry sources are supported today?
Windows Sysmon, Linux auditd, Microsoft 365 and cloud identity logs, and perimeter firewalls. Endpoint and
identity sources are the priority; extra sources are added during onboarding, and early-access customers
get theirs first.
05Do I need to replace my antivirus or EDR?
No. DetectMonkey is designed to sit alongside what you already run. We ingest the telemetry your existing tools
produce and correlate it across endpoints, identities and the perimeter — the alerting layer, not a
replacement for your endpoint protection.
06What does Analyst Response include?
Bilingual analysts review and triage the alerts the platform raises, during 8am–8pm AST on weekdays, and
give your team triage notes and recommended next steps in English or French. Response targets and
after-hours terms are scoped per engagement — we would rather agree them with you than print a promise we
cannot staff.
07What does the Incident Response team provide?
An outsourced, hands-on intervention team for active containment and remediation. Responders handle host
isolation, process termination, credential revocation, emergency war-room coordination, and digital
forensics. Available via custom retainer.
08What does early access cost?
Nothing for 90 days, for up to 100 seats. After that, Monitoring is $150 CAD per month, with up to 10
monitored seats included, and Analyst Response and Incident Response available as tailored add-ons. No
auto-conversion, no card required to start.
09Does Codein work with Canadian businesses?
Yes — Codein is made, hosted, and operated in Canada and works with organizations across Canada.
Onboarding is founder-led, in English or French.
Start with the alert.
Everything else is optional. Tell us what your network looks like and we will wire the first collectors with you.