Skip to content

AI-Driven Secure Log Intelligence

Log intelligence that never leaves your perimeter

Self-hosted log management and threat detection for classified, air-gapped, and regulated networks. Collect, enrich, detect, and respond — entirely inside your environment. No telemetry.

Book a demo Try it — free Docker trial kit

Drag the ring or use ← → to turn it; click a window to explore.

  • FIPS 140-3
  • DISA STIG
  • CIS Level 1
  • OCSF v1.3
  • Air-gap capable

What logrok does

From raw log to resolved incident

Follow one event through logrok. Every window below is the real product, captured from a release appliance.

Collect & route

Every source, one live pipeline

Syslog over TCP, UDP, TLS and RELP, OTLP/gRPC, Kafka, Azure Event Hub, HTTP webhooks and files, drawn as a topology you can read at a glance, with LUnA agents at the edge.

  • NewSNMP traps from network devices and appliances: SNMPv3, v2c and v1
  • NewEvery edge labeled with its own measured rate
  • Each change goes live as a versioned deploy, with rollback
How collection works →
logrok Topology view: sources routed to log partitions with live event rates

Detect & respond

Findings that name the attacker

1,100+ built-in rules mapped to MITRE ATT&CK, correlation, Sigma import and threat intelligence, with every finding opened alongside its evidence.

  • NewFindings name the attacker, not the log forwarder
  • NewThreat-intelligence indicators raise findings, and retro hunts look back up to 90 days
  • Nine curated IOC feeds, off until you enable them
See detection →
logrok Detection: findings raised by built-in rules, with severity and MITRE tactics

Noise control

Drop noise where it's born

logrok extracts and classifies repetitive patterns automatically. For each one you choose to monitor, tag, route or drop it, at ingest or on the sending host, so a dropped event never crosses the network.

  • One fingerprint lookup per event on the host, however many templates
  • NewClassifiers store what they recognize as searchable fields, with 28 ready-made templates
  • NewExport your noise decisions and import them on another installation
How noise control works →
logrok Noise Detection: incoming events by classification over the last day

Comply

Evidence that verifies itself

Seal a search into a signed, encrypted evidence pack that anyone can verify with OpenSSL, sha256sum and zstd, no logrok needed. Licensed DORA, NIS2 and PCI DSS packs add framework-mapped evidence.

  • Tamper-evident audit trail
  • Events classified to OCSF v1.3
Compliance →
logrok Evidence Packs: sealed, signed copies of search results

Agent fleet

Every endpoint, one fleet

LUnA, the logrok universal agent, is one static binary for Windows, Linux and macOS. Enroll, configure, upgrade and monitor every agent from one Agents page, with per-agent mTLS.

  • NewDelivery latency and FIPS posture for every agent
  • NewOperator-signed configurations
  • NewA lost-events breakdown that says why, with a remedy for each cause
Meet LUnA →

Built for the networks others can't reach

Cloud SIEMs send your logs off-site.

Every event leaves your perimeter for a vendor cloud you can't fully audit — a non-starter for classified, air-gapped, and regulated networks.

Legacy SIEMs need a rule-engineering army.

Months of tuning, brittle correlation rules, and per-GB bills that punish you for collecting more of the data you need.

AI bolt-ons call home.

Most “AI security” ships your data to someone else's model. logrok runs detection where your data already lives.

Deploy it your way

VM appliance

FIPS- and STIG-hardened AlmaLinux appliance as OVA, QCOW2, or VHDX — VMware, Proxmox/KVM, and Hyper-V.

Air-gapped

Offline container images. No call-home license activation.

Kubernetes

A Helm chart from the logrok registry, against your own PostgreSQL, Keycloak and Apache Doris. FIPS images by default.

Docker Compose

A free single-host trial kit on the Community tier — up and searching in minutes.

FIPS 140-3 (OS-level CMVP #5482) · DISA STIG · CIS Level 1 · NIST SP 800-53 aligned · CMMC Level 2 supported · OCSF v1.3

Zero telemetry. Sovereign on-premises operation.

See logrok on your own data

Book a guided demo, or stand up the free trial kit with Docker Compose and have your first log searchable in minutes.

Book a demo Explore the platform