SIM swap detection from the logs you already have
SIM swap, eSIM clone, and IMSI catcher leave traces in separate systems. No single tool reads them together.
CYBERDETECT reads the SIM and subscriber events you already produce, links them into one incident, and alerts Slack, Teams, or your SOAR. It sits outside live traffic and does not connect to the carrier core.
The telco pack covers SIM swap, SIM and eSIM clone, and IMSI catcher. SMS smishing is a separate pack on the same timeline, so a swap and the message that follows it can be seen together.
It can go live the same day. A case that is not in the pack yet only needs the logs or events for that case.