Unified log collection
Ingest from syslog (TCP, UDP, TLS, RELP), OTLP/gRPC with per-batch acknowledgment, HTTP webhooks, Kafka, Azure Event Hub, and files. Up to 150K+ events/sec sustained on a single appliance node.
The platform
Collect, enrich, detect, and respond — on your own infrastructure
logrok unifies log management and threat detection in one self-hosted platform. Everything below runs inside your environment, with no telemetry.
Collect & route
Every source into one pipeline you can see
Visual pipeline editor
Drag-and-drop topology builder for collection pipelines. Generate (with the AI assistant), deploy, and version configs visually, with a comment and a searchable history for every change. Processors include GeoIP enrichment, classifiers, and lookup tables.
Agent fleet management
Enroll LUnA agents with one-time tokens, deliver configuration by group, upgrade agents remotely from the Agents page, deliver signed entitlements, and rotate the agent root CA without taking the fleet down. Each agent reports its license state, and a failed integrity check on its disk buffer raises a Tamper alert.
Monitor mode shows events per second or throughput on every edge, and each change goes live with a versioned, commented deploy.
Search & analyze
From a question to the log line in seconds
Five search modes
Text, regex, Query (Lucene-style field queries), SQL filter expressions (admin only), and natural-language AI search. Results load as you scroll and follow each user's log-partition permissions.
Dashboards & alerting
Custom dashboards with live widgets. Alert rules on patterns, thresholds, or anomalies.
Switch a result set to Patterns, Statistics or a chart; ask what stands out in a spike; save views and share them with your team; export CSV, JSON or NDJSON.
Detect & respond
Detections mapped to MITRE ATT&CK, out of the box
Detection engine
1,100+ built-in detection rules — a baseline set active out of the box and a Windows pack you activate per agent group — with MITRE ATT&CK mapping, correlation logic, and a custom rule DSL. Nine curated threat-intelligence feeds, once enabled, are matched against your logs.
Tamper-evident audit trail
Append-only, hash-chained audit log of significant platform actions, attributable per user — accountability for compliance and forensic review.
Import Sigma rules, see your technique coverage on a MITRE ATT&CK heatmap, and open each finding with its evidence and suggested investigation queries.
Reduce noise
Pay for the logs that matter
Noise enforcement
Repetitive patterns are extracted automatically and classified as noise, useful, or unclassified. For each pattern you choose to monitor, tag, route, or drop it — at ingest or at the sending host — and tag and route apply to data already stored.
Archive & rehydration
Export each day's logs to S3-compatible object storage as Parquet, with a schedule, retention threshold, and credential per archive destination. Licensed rehydration replays an archived range back into a searchable logspace.
Encrypted storage & 20+ destinations
AES-256-GCM sealed-file destinations with hash-chain tamper evidence. Route to S3, Kafka, Splunk, Elasticsearch, Azure, GCP, Loki, Datadog, and more.
Prove compliance
Evidence an auditor can verify without logrok
Evidence & compliance packs
Evidence packs seal a search into a signed, encrypted archive that anyone can verify with OpenSSL, sha256sum and zstd, without logrok. Licensed DORA, NIS2 and PCI DSS packs add framework chips to a shared risk register, business-continuity and retention-posture pages; DORA adds Article 18 incident classification and a major-incident simulator, and PCI DSS a Requirement 10 evidence bundle.
Identity & access control
SSO with MFA — FIDO2 security keys, passkeys, and CAC/PIV smart cards — and LDAP/AD, SAML 2.0, and OIDC federation. Five built-in roles, including a read-only auditor and a compliance officer, and tenant isolation enforced by database row-level security.
OCSF classification
Events classified to OCSF v1.3 for vendor-neutral detection rules and data-lake federation.
Operate
An appliance that explains itself
Built to operate
A Network & ports card on System Status lists every listening port and whether the host firewall has it open. One-click support bundle with secrets redacted, appliance upgrades with rollback, and automatic recovery of a stuck database backend.
AI, honestly
AI that runs where your data lives
Noise filtering
Classifies repetitive patterns as noise, useful, or unclassified; you decide per pattern whether to tag, route, or drop it.
Investigation assistant
Produces a context brief, suggested search queries, related MITRE ATT&CK techniques, and recommended response actions for a finding, and an AI summary on incidents the risk watcher opens.
Natural-language search
Turns a plain-language question into an editable Query-mode expression, and falls back to a plain text search if the AI provider is unavailable.
Risk scoring
A statistical per-host score from 0 to 100 against each host's own baseline — volume, error rate, severity, and diversity — that can open an incident automatically when a threshold is crossed.
MCP server
Exposes logrok operations to AI agents and workflow tools over the Model Context Protocol.
AI features are off by default and use the provider you configure. Point them at a self-hosted model (Ollama or an OpenAI-compatible gateway) and prompts stay on your network, including in air-gapped sites; hosted providers send data out of it. Detection rules, risk scoring, and threat-intelligence matching need no AI provider.
Architecture
Three planes, scaled independently
Control Plane
REST API, web UI, and an AI agent interface. Pipelines, search, alerts, and automation.
Ingest Plane
High-performance log collector with config agents. Zero-touch pipeline deployment.
Data Plane
SQL analytics engine, a config store with row-level security, and SSO.
The collection layer
Every log starts at the edge — LUnA brings it in
All of this ends in detection, not a database — but only once the logs arrive. LUnA, the logrok universal agent, is the front door to the ingest plane: a single static binary for Windows, Linux, and macOS that forwards RFC 5424 syslog or acknowledged OTLP/gRPC into the platform above.
Meet LUnA