A SIEM for Security EnthusiastsStartupsGrowing TeamsEnterprises
A lightweight, AI-powered security event platform. Rust + ClickHouse performance. Predictable pricing. No per-GB surprises.
Query editor
...source_type=sysmon
where risk > 50
table user, cmd
processing...
Results Timeline
847 events
rarefirst_seen: now
riskuser: jsmith
AI Ready"summarize..."
What makes us different
Most SIEMs share infrastructure between tenants and charge by the GB. We don't do either.
Sub-second search over billions of events
Built on ClickHouse columnar storage and a Rust backend. Queries that take minutes elsewhere finish in under a second.
Always on when it matters most
Kubernetes-native with health checks, auto-restarts, and horizontal scaling. Backed by a contractual uptime guarantee.
Your infrastructure. Not a shared cluster.
Every tenant gets isolated compute, storage, and network policies. No noisy neighbors. No shared infrastructure. On every plan.
Meet pivt AI
An AI engine woven into every surface of nano — from writing detections to investigating incidents. It understands security, not just syntax.
Writes production-ready detection rules from plain English threat descriptions
Summarizes alerts, suggests pivots, and explains anomalies in context
Generates log parsers from raw samples — no regex required
Translates natural language questions into optimized queries instantly
AI that actually helps
Generate detection rules, parsers, and queries from plain English. Our AI assistant understands security not just syntax.
AI Query Creator
Describe what you're looking for. Get the query instantly.
AI Parser Generator
Drop in a log sample. Get a working parser. No regex headaches.
AI Investigation Assistant
Summarize findings, suggest pivots, explain anomalies.
AI Detection Writer
Describe the threat. Get a production-ready detection rule.
ClickHouse speed. Rust reliability.
Queries that take minutes elsewhere finish in seconds. Powered by ClickHouse columnar storage and a Rust backend that doesn't break.
source_type = proxy user = jsmith
earliest = -24h
source_type = proxy user = jsmith earliest = -24h
stats count , sum ( bytes_out ) as total_bytes
as total_bytes
by dest_host
where count > 100
sort - total_bytes
processing...
AI Generated Query:
Detect in real-time. Or on schedule.
Sub-30-second detection with materialized views for simple IOCs. Complex correlations run on flexible schedules. Test rules in staging before they alert.
Detect powershell
Launched by office_apps 
By user : jsmith 
Encoded command
New user session
Detect powershell
Launched by office_apps
By user : jsmith
Encoded command
New user session
Materialized Views
Real-time detection, sub-30s latency
Staging Mode
Test rules before they fire alerts
MITRE Mapping
Auto-tagged with ATT&CK techniques
Risk Accumulation
Entity risk scores that decay over time
Rare = interesting
Prevalence tracking out of the box. Instantly see what's rare, what's first-seen, and what deserves attention. Filter by prevalence right in your queries.
Prevalence Radar
source_type=proxyuser=jsmith
earliest=-24h
prevalencewindow=7d
enrich=true
wherehost_count<5
whereis_rare=true
tabledest_host,
host_count,
Prevalence Radar
source_type=proxyuser=jsmith
earliest=-24h
prevalencewindow=7d
enrich=true
wherehost_count<5
whereis_rare=true
tabledest_host,host_count,
Parsers without the pain
50+ out-of-the-box parsers for common log sources. Need a custom one? Paste a sample, and our AI builds it for you. Hot-reload without restarts.
INFOBOX DHCP 
GENERIC JSON 
ZEEK 
APACHE 
SYSMON 
SNORT 
NGINX 
WINDOWS DEFENDER 
SQUID PROXY 
CISCO ASA 
AI PARSER FLOW
2024-01-15 10:42:33 INFO
user = jsmith action = login
src = 192.168.1.50 status = ok
AI PARSER AGENT
Generated VRL Parser
. = parse_key_value (...)
.user = .user
.action = .action
.src_ip = .src
Validated against sample
Investigation:SUSPICIOUS_POWERSHELL_ACTIVITY
@search source_type=sysmon user=jsmith
~847 results
@pivot Added src_ip=192.168.1.50
@alert Matched: "Encoded PowerShell"
~Severity: High | Risk: +75
@summarize
~AI: "User jsmith executed encoded PowerShell from IP 192.168.1.50. Recommend checking parent process..."
@ioc Added: evil-payload.exe (SHA256:…
Never lose your thread
Every search, every alert, every detection—automatically captured. AI suggests pivots and summarizes findings. Hand off investigations without losing context.
No per-GB surprises
Simple, predictable pricing. No ingestion fees that scale with your data. No surprise bills at the end of the month. Just straightforward cost you can plan for.
Predictable flat pricing
Scales with your needs
Portable, open data
Know your cost upfront
Cost Estimate
Flat monthly price
No metered ingestion charges
Recommended
Traditional SIEM
$150/GB/day pricing
Scales with data volume
Vendor data lock-in
Surprise monthly bills
Cost Estimate
~$5.5M
Based on 100GB/day ingestion
Ready to hunt?
Get started in minutes. No credit card. No sales call.