Own Your Flow of Logs
From source to alert, every step runs in your own environment. You decide what is collected, what is kept and how you react.
1. Connect
The ingester connects to AWS, GCP, GitHub, 1Password, Slack, Google Workspace, Cloudflare, with more sources coming.
2. Normalise
Vector normalises every record and stores it. Raw logs are kept for six years.
3. Detect
Sigma rules run per source, such as a GitHub lane and an AWS lane. 65 rules, each with a test.
4. Search
Every log can be queried in Quickwit or Grafana.
5. React
Alerts are delivered to Slack and GitHub, where your team works.
Connect Your Sources
Share on Your Terms
When you control the flow, you choose who else sees it.
Connect External SIEMs
Forward your logs to one or several external SIEM providers and get their alerts back.
Why Only One?
Split the same stream to several providers and let them all alert on it.
Filter Before You Share
Why send all your data to an external SIEM? Choose exactly which data leaves your pipeline.
Anonymise
Replace sensitive values before they are shared, for example swap the CEO's name for an alias.
Run It Anywhere
Easy to deploy and cheap to run, wherever your workloads live.
AWS
Deploys with Terraform into your own account. Cheap to run.
GCP
Runs in your Google Cloud project. Easy to deploy.
On-prem Kubernetes
Runs in your own cluster, next to your workloads.
Choose Your Deployment
Each SIEM answers a different question. Pick the one that matches where your workloads run. If you run Kubernetes on AWS, run both.
Kubernetes SIEM
What is happening inside my cluster?
A lightweight rule engine that runs next to your workloads. Cluster events stream over NATS and are matched against compliance-mapped YAML rules.
- Runs in any Kubernetes cluster
- YAML rules with PCI DSS, NIST, MITRE ATT&CK and more
- Alerts in Elasticsearch or Loki, viewed in Grafana
- Installs with Helm charts and plain manifests
AWS SIEM
What is happening in my cloud and SaaS accounts?
An AWS-native pipeline built from S3, SQS, ECS Fargate and Lambda. It collects AWS, GitHub and SaaS audit logs, runs Sigma detections, and sends alerts to Slack and GitHub.
- Deploys with Terraform into your own AWS account
- Sigma detection rules, each with tests
- Alerts to Slack and GitHub issues
- Search in Quickwit and Athena, with Grafana dashboards
Detection Inside Your Cluster
A Kubernetes-native rule engine that processes cluster events through a real-time NATS pipeline, with compliance-aware rules.
YAML-Based Rules
Each rule names a severity, the NATS subject to publish alerts on, and its compliance mappings. Match on any field with nested and/or logic using equals or regex. Version-control the rule set alongside your infrastructure.
NATS Event Streaming
Fluent Bit and Vector publish cluster logs to NATS. The rule engine subscribes, evaluates every event as it arrives, and publishes matches to per-rule alert subjects.
Vector.dev Pipeline
Vector formats logs on the way in and acts as the alert sink on the way out. It writes every alert to your storage backend, indexed by severity.
Elasticsearch or Loki
Store alerts in Elasticsearch or Loki. Bundled Grafana dashboards break them down by compliance framework and by service.
Compliance Frameworks
Every rule maps to one or more compliance frameworks, so you know which standards are covered and where the gaps are.
PCI-DSS
Payment Card Industry Data Security Standard
GDPR
General Data Protection Regulation
HIPAA
Health Insurance Portability and Accountability Act
NIST 800-53
Security and Privacy Controls for Information Systems
MITRE ATT&CK
Adversarial Tactics, Techniques, and Common Knowledge
A Kubernetes Rule
Plain YAML: what to match, how severe it is, and where the alert goes.
name: k8s-anonymous-access
description: Detects anonymous or unauthenticated API requests
severity: critical
nats_subject: samma.alerts.k8s.anonymous_access
compliance:
pci_dss: ["10.2.5", "8.1.2"]
nist_800_53: ["AC.2", "IA.2"]
mitre: ["T1078"]
match:
and:
- field: kind
equals: Event
- field: user.username
equals: "system:anonymous"Detection Across Your Cloud and SaaS
An AWS-native pipeline that follows each log from S3, through Sigma detections, to alerts in Slack and GitHub, with search over everything.
S3 Landing Zones
AWS and GitHub push logs straight to S3, and an ingester Lambda pulls Slack, 1Password, Google Workspace, GCP and Cloudflare. Every record is kept raw for six years.
Vector Filtering
Vector on ECS parses, filters and normalises each record into one of nine log lanes. SQS carries only S3 events, so any stage can be re-driven from S3.
Sigma Detections
A stateless Go engine runs Sigma rules, one service per lane. The rules are imported from SigmaHQ or written in-house, and every rule ships with a test.
Slack & GitHub Alerts
Every alert is archived to S3 and then routed by severity and lane: to Slack, and for critical alerts to a GitHub issue.
Quickwit & Athena Search
Full-text search over the last 90 days in Quickwit, and SQL over everything in Athena.
Grafana Dashboards
Ready-made dashboards over Quickwit and Athena, behind OIDC login.
A Sigma Rule
Standard Sigma, so rules from SigmaHQ work too.
title: CloudTrail Logging Disabled
level: high
tags:
- attack.defense_evasion
- attack.t1562.008
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: cloudtrail.amazonaws.com
eventName:
- StopLogging
- DeleteTrail
- UpdateTrail
- PutEventSelectors
condition: selectionThe AWS SIEM is pre-release: there are no published images yet, so you build them yourself. The deploy guide walks through it.
How They Fit Together
The Kubernetes SIEM watches the cluster. The AWS SIEM watches the account it runs in. Today they run side by side and share no data, so you can adopt either one on its own.
| Kubernetes SIEM | AWS SIEM | |
|---|---|---|
| Runs on | Any Kubernetes cluster | Your AWS account (S3, SQS, ECS Fargate, Lambda), GCP or on-prem Kubernetes |
| Input | Container logs and Kubernetes audit events | CloudTrail, VPC flow, DNS, ALB, GitHub, Slack, 1Password, Google Workspace, GCP, Cloudflare |
| Rules | Samma YAML, compliance-mapped | Sigma, with a test per rule |
| Alerts | NATS → Elasticsearch or Loki → Grafana | S3 archive → Slack → GitHub issues |
| Search | Grafana over Elasticsearch or Loki | Quickwit, Athena and Grafana |
| Install | Helm charts and manifests | Terraform |
You can't choose whether you get hacked. You can choose how fast you detect it and how you react.
It's time to take detection seriously. Owning your flow of logs is where it starts.
Read the Guides
Hands-on chapters take you from how the data flows to a running SIEM.