Build Your Security Data Lake in Hours

Building a log collection pipeline requires writing code to handle API  pagination, rate limiting, authentication, retries, and monitoring for each source. Then you need to maintain it as APIs change. Scanner Collect provides dozens of pre-built integrations that handle all of this automatically, getting you from zero to collecting logs in under 5 minutes instead of weeks of engineering time.

All index data is stored in your own S3 buckets in your AWS account. Scanner never takes custody of your data. You can deploy Scanner in the same region as your buckets to avoid cross-region costs and meet data residency requirements.

Yes! Scanner provides integrations for both GCP and Azure, allowing you to the index log data you have in GCS buckets and Azure Blob Storage containers. Scanner still runs in AWS, but due to the work Scanner does to compress data before transit, transferring a terabyte of logs only costs one to two lattes ($6 to $12) in data transfer costs.

Yes! Scanner has dozens of integrations to pull logs from SaaS tools, like Okta, Google Workspace, SentinelOne, and more. Rather than pivot between these tools during an investigation, you and your AI agents can query them easily and rapidly in Scanner's data lake.

Yes! Typically, teams configure Scanner to tap into the data streams, like Kafka or Kinesis, that feed into their lakes and warehouses. But you can also configure your lakes/warehouses to forward their data to S3, where Scanner can index the data. With either approach, teams quick achieve fast search and detection on the raw data, often skipping heavy data engineering ETL work (and ingestion delays) typically associated with loading data into lakes and warehouses.

Transformations and enrichment happen during ingestion, so they only apply to new logs. Historical logs are not retroactively modified. If you need to re-process historical data with new transformations, you can trigger a re-indexing job.