Built for Modern Log Volumes
Fast Investigations
Save valuable time during critical incidents. Find IP addresses in a petabyte of logs, in seconds.Most Affordable
Unlock the full potential of log search without cost concerns with a 90% reduction in expenses.Eliminate SIEM Blindspots
Unlimited log retention to get visibility into threats and risks other tools miss.
Unlock the Power
of Your Security Data
Full-text Log Search
Easy schema-less search to find a needle-in-haystack across 100TB of logs in less than 10 seconds.- Results InvestigationExplore search results with customizable table columns and result details.
- Powerful AggregationsCreate comprehensive aggregate metrics using a powerful query language.
- Saved QueriesInstantly rerun important searches for your entire team.
Detections
Rapidly respond to security threats with out-of-the-box and fully customizable detection rules and alerts.- Detections IndexView and search all detection events in a consolidated index.
- Out-of-the-box RulesGet started fast with common detection rules written by Scanner.
- Detections as CodeCreate and manage detection rules directly from GitHub.
Scanner API
Turn your logs in S3 into an API. Search your historical logs from the tools you already use. Enrich alerts with historical context.- Search APIQuery logs from S3 for anything over any given start and end times, even spanning years.
- Detection Rules APICreate, retrieve, update, and delete detections rules. Sync GitHub repos and validate YAML files.
- Event Sink APICreate event alert destinations as well as read, update, and delete.
