The rule engine is free at every tier and never sends data anywhere. Paid tiers add stored investigations, the dashboard, more Claude explanations and support. Prices are pilot prices during 2026 and exclude VAT.
Try it on real events, no account needed.
For one SOC team that wants cases, not alerts.
Many customers, one console, strict separation.
Your servers, your model, your data residency.
One analysis where Claude writes the summary, weighs the evidence and proposes next steps. Rule-engine analyses never count.
Users, devices and IP addresses are replaced in your browser before anything is sent. The pseudonymized events are stored for your tenant only (Team and above); the mapping back to real names stays inside your tenant.
Yes. Every tier works with the rule engine alone, and Self-hosted can run a local model instead of the Claude API.
Create a Team account, run your own exports for two weeks, and tell us what the engine got wrong. Pilot customers keep the pilot price for twelve months.