AI-Driven Secure Log Intelligence
Self-hosted log management and threat detection for classified, air-gapped, and regulated networks. Collect, enrich, detect, and respond — entirely inside your environment. No telemetry.
SearchFive search modes, from text to AI
TopologyA measured rate on every edge
DetectionFindings that name the attacker
DashboardPipeline rates and ingest loss at a glance
AgentsDelivery latency, FIPS posture, signed configs
Evidence packsSigned evidence anyone can verify
Classifiers28 ready-made templates, every field searchable
Noise detectionDrop noise at the source
Scroll or drag to look around · click a window to walk up to it
What logrok does
Follow one event through logrok. Every window below is the real product, captured from a release appliance.
Collect & route
Syslog over TCP, UDP, TLS and RELP, OTLP/gRPC, Kafka, Azure Event Hub, HTTP webhooks and files, drawn as a topology you can read at a glance, with LUnA agents at the edge.
Search
Plain text, regular expressions, field queries, SQL filters and natural-language AI over the same log store. Switch any result to Patterns, Statistics or a chart, and ask what stands out in a spike.
Detect & respond
1,100+ built-in rules mapped to MITRE ATT&CK, correlation, Sigma import and threat intelligence, with every finding opened alongside its evidence.
Noise control
logrok extracts and classifies repetitive patterns automatically. For each one you choose to monitor, tag, route or drop it, at ingest or on the sending host, so a dropped event never crosses the network.
Comply
Seal a search into a signed, encrypted evidence pack that anyone can verify with OpenSSL, sha256sum and zstd, no logrok needed. Licensed DORA, NIS2 and PCI DSS packs add framework-mapped evidence.
Agent fleet
LUnA, the logrok universal agent, is one static binary for Windows, Linux and macOS. Enroll, configure, upgrade and monitor every agent from one Agents page, with per-agent mTLS.
Every event leaves your perimeter for a vendor cloud you can't fully audit — a non-starter for classified, air-gapped, and regulated networks.
Months of tuning, brittle correlation rules, and per-GB bills that punish you for collecting more of the data you need.
Most “AI security” ships your data to someone else's model. logrok runs detection where your data already lives.
FIPS- and STIG-hardened AlmaLinux appliance as OVA, QCOW2, or VHDX — VMware, Proxmox/KVM, and Hyper-V.
Offline container images. No call-home license activation.
A Helm chart from the logrok registry, against your own PostgreSQL, Keycloak and Apache Doris. FIPS images by default.
A free single-host trial kit on the Community tier — up and searching in minutes.
FIPS 140-3 (OS-level CMVP #5482) · DISA STIG · CIS Level 1 · NIST SP 800-53 aligned · CMMC Level 2 supported · OCSF v1.3
Zero telemetry. Sovereign on-premises operation.
Book a guided demo, or stand up the free trial kit with Docker Compose and have your first log searchable in minutes.