Security leadership · CISO
Fewer tools to own, and a coverage number you can defend.
What the platform replaces, how its detection coverage is measured rather than claimed, and the gaps we publish ourselves.
Security on one event record · on-premise or SaaS
Stop buying the same event eleven times.
Each security tool you run keeps its own agent, its own copy of what happened and its own bill. EventLake records every event once, signs it so any later change shows (we call that sealing), and lets every capability read that one record. You pay for the data you ingest. Everything else is included.
web-07one host, one event
One record
stored once
✓ sealed · ed25519
events: 0
Illustrative stack: one product per category, each with its own agent, copy and meter.
11copies of each event
11consoles to watch
11ways you are billed
4agents on each host
- 01 · Ingest 139 built-in sources & one Sensor Endpoint, network, cloud, identity and application telemetry arrive over open formats or one host binary. Every source it reads →
- 02 · Seal One Ed25519-sealed event record Shaped once into twenty-odd named fields, linked to its causal parent, and signed on arrival before any analytic reads it. Anatomy of an event →
- 03 · Act Four layers, one approval step Analytics, execution, identity and governance read the same record and write every containment or approval back into it. How the four layers work →
Start where you sit
One platform, five ways in.
Every buyer asks a different first question. Pick yours; the three pages beside it answer it in the order you would ask.
SOC analyst · detection engineer
One record per event, and an alert you can check.
The fields every event carries, how a finding cites the records behind it, and the sources it reads today.
Security architect
Four layers on one event record, on-premise or SaaS.
How the layers stand on the event floor, what the agent does per operating system, and how every response action passes one approval step (the gate).
Compliance · auditor · DPO
Evidence you can walk back to the record that produced it.
What is collected about people and what an erasure deletes, the frameworks mapped as code, and how to verify what you installed.
Procurement · CFO
One meter: the data you ingest each day.
The plans and what each includes, a sizing worksheet for your estate, and how a time-bound trial licence works.
What you buy
Four things that are only true on one record.
All four can be checked inside a trial on your own hardware. None of them asks you to take our word for it.
One agent, not five
The same binary on the host does detection, application firewalling, identity enforcement and posture. One thing to install, one thing to upgrade, one place a decision is applied.
The lesson becomes the rule
What the platform learns on one machine is compiled into a rule the agent enforces by itself. The second machine to try the same thing meets a rule, not a queue.
Every action is itself an event
Containment, revocation and each approval decision are written into the same sealed stream as the activity that prompted them. Your audit trail and your evidence are one record.
Sealed on arrival
Each event is signed with Ed25519 as it is ingested, before any analytic reads it. Try it: change one byte and the seal stops matching.
- subject
- svc-nginx on web-07
- object
- /bin/sh · ppid 1041
- dst
- 10.4.1.22:5432 · billing-db
✓ seal verified · ed25519
Timings and hosts above are illustrative, from the platform page's worked example. A seal proves the record, not the world.
Measured, not claimed
475 of 697 ATT&CK Enterprise techniques detected, measured at runtime
A build-time guard reads this figure from the page and compares it with the running platform’s own coverage count; a page that drifts from the code does not ship.
How many MITRE ATT&CK techniques it detects, measured at runtime rather than claimed →
Pricing
The price follows one number.
No per-seat fees and no per-module gating. The only thing that moves the price is the data you ingest each day, so there is nothing to upsell once you are in.
3.0TB / day on-prem
Business · up to 5 TB/day on-prem · 100 GB/day in Cloud
Pulse · 0.25Starter · 1Business · 5Enterprise · 15beyond
Seatsnot metered
Modulesnot metered
Data per daythe one meter
Included at every volume
Every plan includes 365-day searchable retention and 139 built-in connectors. Prices are on the pricing page.
Trial licence
Thirty days, every capability on.
Start in your own organisation on the EventLake Console the same day, with every capability on. For an evaluation on your own hardware, our team issues a signed licence that your node verifies offline.
Volume is the only ceiling
Put the agent on everything. The trial bounds the data per day, not the machine count.
The clock starts at issue
Thirty days from when the licence is issued, so open the link when someone is ready to use it.
One automatic trial per organisation
No free tier. A trial is how you prove it on your own data before you buy.
Start here
See your estate as one record.
Request a trial licence, install one Sensor, and follow your first event from the host that saw it to the rule it changed.