Own Your Flow of Logs
From source to alert, every step runs in your own environment. You decide what is collected, what is kept and how you react.
1. Connect
The ingester connects to AWS, GCP, GitHub, 1Password, Slack, Google Workspace, Cloudflare, with more sources coming.
2. Normalise
Vector normalises every record and stores it. Raw logs are kept for six years.
3. Detect
Sigma rules run per source, such as a GitHub lane and an AWS lane. 65 rules, each with a test.
4. Search
Every log can be queried in Quickwit or Grafana.
5. React
Alerts are delivered to Slack and GitHub, where your team works.
Connect Your Sources
Share on Your Terms
When you control the flow, you choose who else sees it.
Connect External SIEMs
Forward your logs to one or several external SIEM providers and get their alerts back.
Why Only One?
Split the same stream to several providers and let them all alert on it.
Filter Before You Share
Why send all your data to an external SIEM? Choose exactly which data leaves your pipeline.
Anonymise
Replace sensitive values before they are shared, for example swap the CEO's name for an alias.
Run It Anywhere
Easy to deploy and cheap to run, wherever your workloads live.
AWS
Deploys with Terraform into your own account. Cheap to run.
GCP
Runs in your Google Cloud project. Easy to deploy.
On-prem Kubernetes
Runs in your own cluster, next to your workloads.
Choose Your Deployment
One SIEM, two ways to run it. Pick the one that matches where your workloads run. If you run Kubernetes on AWS, you can run both.
Kubernetes SIEM
Can my SIEM run inside my own cluster?
The same ingester, Vector, detection engine and Sigma rules as the AWS SIEM, running next to your workloads. The parts talk over NATS JetStream instead of S3 and SQS.
- Runs in any Kubernetes cluster
- The same Sigma rules as the AWS SIEM, each with tests
- Alerts to Slack and GitHub issues
- Search in Quickwit, with Grafana dashboards
AWS SIEM
What is happening in my cloud and SaaS accounts?
An AWS-native pipeline built from S3, SQS, ECS Fargate and Lambda. It collects AWS, GitHub and SaaS audit logs, runs Sigma detections, and sends alerts to Slack and GitHub.
- Deploys with Terraform into your own AWS account
- Sigma detection rules, each with tests
- Alerts to Slack and GitHub issues
- Search in Quickwit and Athena, with Grafana dashboards
Detection Inside Your Cluster
The same pipeline as the AWS SIEM, inside your cluster: the ingester, Vector, Sigma detections per lane and alerts, all connected over NATS JetStream.
Sigma Rules per Lane
The detection engine runs Sigma rules, one service per lane, in the same rule format as the AWS SIEM. Rules from SigmaHQ work too, and every rule ships with a test.
NATS JetStream
The ingester pulls SaaS audit logs onto NATS JetStream. Alerts go on their own stream, then on to Slack and GitHub issues.
Vector Normalisation
Vector normalises every record into its lane before detection, with the same configuration the AWS pipeline runs.
S3, Postgres, Quickwit & Grafana
Data is kept in S3 and Postgres (TimescaleDB), with alerts in their own table. Search every log in Quickwit and view it in Grafana dashboards.
Compliance Frameworks
Every rule maps to one or more compliance frameworks, so you know which standards are covered and where the gaps are.
PCI-DSS
Payment Card Industry Data Security Standard
GDPR
General Data Protection Regulation
HIPAA
Health Insurance Portability and Accountability Act
NIST 800-53
Security and Privacy Controls for Information Systems
MITRE ATT&CK
Adversarial Tactics, Techniques, and Common Knowledge
A Kubernetes Rule
The same Sigma format as the AWS SIEM: what to match and how severe it is.
title: Google Workspace Two-Step Verification Disabled
level: critical
tags:
- attack.defense_evasion
- attack.persistence
logsource:
product: workspace
service: reports
detection:
selection:
source: workspace
feed: admin
name:
- UNENFORCE_STRONG_AUTHENTICATION
- TURN_OFF_2_STEP_VERIFICATION
condition: selectionDetection Across Your Cloud and SaaS
An AWS-native pipeline that follows each log from S3, through Sigma detections, to alerts in Slack and GitHub, with search over everything.
S3 Landing Zones
AWS and GitHub push logs straight to S3, and an ingester Lambda pulls Slack, 1Password, Google Workspace, GCP and Cloudflare. Every record is kept raw for six years.
Vector Filtering
Vector on ECS parses, filters and normalises each record into one of nine log lanes. SQS carries only S3 events, so any stage can be re-driven from S3.
Sigma Detections
A stateless Go engine runs Sigma rules, one service per lane. The rules are imported from SigmaHQ or written in-house, and every rule ships with a test.
Slack & GitHub Alerts
Every alert is archived to S3 and then routed by severity and lane: to Slack, and for critical alerts to a GitHub issue.
Quickwit & Athena Search
Full-text search over the last 90 days in Quickwit, and SQL over everything in Athena.
Grafana Dashboards
Ready-made dashboards over Quickwit and Athena, behind OIDC login.
A Sigma Rule
Standard Sigma, so rules from SigmaHQ work too.
title: CloudTrail Logging Disabled
level: high
tags:
- attack.defense_evasion
- attack.t1562.008
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: cloudtrail.amazonaws.com
eventName:
- StopLogging
- DeleteTrail
- UpdateTrail
- PutEventSelectors
condition: selectionThe AWS SIEM is pre-release: there are no published images yet, so you build them yourself. The deploy guide walks through it.
How They Fit Together
Both run the same components and the same Sigma rules. On AWS the parts talk through S3 and SQS; on Kubernetes they talk through NATS JetStream. They share no data, so you can adopt either one on its own.
| Kubernetes SIEM | AWS SIEM | |
|---|---|---|
| Runs on | Any Kubernetes cluster | Your AWS account (S3, SQS, ECS Fargate, Lambda), GCP or on-prem Kubernetes |
| Input | SaaS audit logs, pulled by the ingester onto NATS JetStream | CloudTrail, VPC flow, DNS, ALB, GitHub, Slack, 1Password, Google Workspace, GCP, Cloudflare |
| Rules | Sigma, with a test per rule (the same rules as AWS) | Sigma, with a test per rule |
| Alerts | Own NATS stream → Postgres table → Slack → GitHub issues | S3 archive → Slack → GitHub issues |
| Search | Quickwit and Grafana | Quickwit, Athena and Grafana |
| Install | Helm charts and manifests | Terraform |
You can't choose whether you get hacked. You can choose how fast you detect it and how you react.
It's time to take detection seriously. Owning your flow of logs is where it starts.
Read the Guides
Hands-on chapters take you from how the data flows to a running SIEM.