Scanner provides a cloud-native security data lake designed to handle large volumes of security logs stored in object storage. It enables lightning-fast full-text search and continuous evaluation of detection rules across petabytes of data without ingestion costs. The platform supports API-first architecture and native Model Context Protocol (MCP) for efficient AI security workloads.
Funding
Funding not disclosed
Founders
Product
Problem
Traditional Security Information and Event Management (SIEM) and observability platforms can be expensive and complex, often requiring significant infrastructure and specialized expertise. This complexity makes it difficult for organizations to efficiently search and analyze large volumes of log data for threat detection and incident response, especially when dealing with long-term data retention requirements.
Solution
Scanner is a lightweight SIEM and observability platform that directly indexes log data stored in Amazon S3, enabling rapid full-text search across historical logs. By leveraging existing S3 infrastructure, Scanner significantly reduces the cost and complexity associated with traditional SIEM solutions. The platform provides customizable detection rules and a streamlined approach to log management, empowering users to perform fast investigations, enhance threat detection, and maintain complete data ownership without vendor lock-in. Scanner also offers an API to query logs from S3 directly inside Splunk, Grafana, and Jupyter Notebooks.
Target Audience
Scanner is designed for security engineers, analysts, and IT professionals who need a cost-effective and efficient solution for log management, threat detection, and incident response, particularly those leveraging Amazon S3 for data storage.
Features
- Indexes logs directly in S3 for cost-effective storage and search
- Enables full-text search across years of log data in seconds
- Offers customizable detection rules for rapid threat detection and incident response
- Provides a consolidated index for viewing and searching detection events
- Supports out-of-the-box detection rules for common security threats
- Allows managing detection rules as code directly from GitHub
- Exposes a Scanner API to query historical logs from Splunk, Grafana, and Jupyter Notebooks
- Offers integrations with Splunk, Grafana, and Jupyter Notebooks