Security leadership · CISO
Fewer tools to own, and a coverage number you can defend.
What the platform replaces, how its detection coverage is measured rather than claimed, and the gaps we publish ourselves.
Security on one event record · on-premise or SaaS
Stop buying the same event eleven times.
Each security tool you run keeps its own agent, its own copy of what happened and its own bill. EventLake records every event once, seals it, and lets every capability read that one record. You pay for the data you ingest. Everything else is included.
web-07one host, one event
One record
stored once
✓ sealed · ed25519
events: 0
Illustrative stack: one product per category, each with its own agent, copy and meter.
11copies of each event
11consoles to watch
11ways you are billed
manyagents on each host
- 01 · Ingest 138 built-in sources & one Sensor Endpoint, network, cloud, identity and application telemetry arrive over open formats or one host binary. Every source it reads →
- 02 · Seal One Ed25519-sealed event record Shaped once into twenty-odd named fields, linked to its causal parent, and signed on arrival before any analytic reads it. Anatomy of an event →
- 03 · Act Four planes, one approval gate Analytics, execution, identity and governance read the same record and write every containment or approval back into it. How the four planes work →
Start where you sit
One platform, five ways in.
Every buyer asks a different first question. Pick yours; the three pages beside it answer it in the order you would ask.
SOC analyst · detection engineer
One record per event, and an alert you can check.
The fields every event carries, how a finding cites the records behind it, and the sources it reads today.
Security architect
Four layers on one substrate, on-premise or SaaS.
How the layers stand on the event floor, what the agent does per operating system, and how response is held at one gate.
Compliance · auditor · DPO
Evidence you can walk back to the record that produced it.
What is collected about people and what an erasure deletes, the frameworks mapped as code, and how to verify what you installed.
Procurement · CFO
One meter: the data you ingest each day.
The plans and what each includes, a sizing worksheet for your estate, and how a time-bound trial licence works.
What you buy
Four things that are only true on one record.
All four can be checked inside a trial on your own hardware. None of them asks you to take our word for it.
One agent, not five
The same binary on the host does detection, application firewalling, identity enforcement and posture. One thing to install, one thing to upgrade, one place a decision is applied.
The lesson becomes the rule
What the analytics plane learns is compiled into enforcement the agent carries out by itself. The second machine to try the same thing meets a rule, not a queue.
Every action is itself an event
Containment, revocation and each approval decision are written into the same sealed stream as the activity that prompted them. Your audit trail and your evidence are one record.
Sealed on arrival
Each event is signed with Ed25519 as it is ingested, before any analytic reads it. Try it: change one byte and the seal stops matching.
- subject
- svc-nginx on web-07
- object
- /bin/sh · ppid 1041
- dst
- 10.4.1.22:5432 · billing-db
✓ seal verified · ed25519
Timings and hosts above are illustrative, from the platform page's worked example. A seal proves the record, not the world.
Pricing
The price follows one number.
No per-seat fees and no per-module gating. The only thing that moves the price is the data you ingest each day, so there is nothing to upsell once you are in.
3.0TB / day on-prem
Business · up to 5 TB/day on-prem · 100 GB/day in Cloud
Pulse · 0.25Starter · 1Business · 5Enterprise · 15beyond
Seatsnot metered
Modulesnot metered
Data per daythe one meter
Included at every volume
Every plan includes 365-day searchable retention and 138 built-in connectors. Prices are on the pricing page.
The path to a decision
Seven questions, in the order you will ask them.
Each page answers one and hands you to the next. Read them in order, or start at the one your team is stuck on.
- 01Why one record?The cost of buying the same event eleven times.
- 02How does it work?Four layers reading one sealed event floor.
- 03What does it do?Every capability, how it is charged, how settled it is.
- 04Is it true?Coverage across every threat matrix, measured at runtime.
- 05Where does it stop?Every limit we publish, in one ledger.
- 06Can we trust it with our data?What is collected, what an erasure deletes, what you can verify.
- 07What will it cost?One meter, then a 30-day trial on your own data.
Trial licence
Thirty days, every capability on.
Start in your own organisation on the EventLake Console the same day, with every capability on. For an evaluation on your own hardware, our team issues a signed licence that your node verifies offline.
- Request
Your name, your work email, your company and the product lines you want to try.
- Verify
We email a single-use link. It works for 24 hours, and opening it proves the address is yours.
- Account
Opening the link creates your organisation with you as its first administrator. You set up your own sign-in; no password is ever sent.
- Licence
A first trial’s 30-day licence is issued on the spot, inside your organisation, never by email. A repeat request waits for our team.
- Run it
Install the Sensor on as many machines as you like and watch one record fill.
Volume is the only ceiling
Put the agent on everything. The trial bounds the data per day, not the machine count.
The clock starts at issue
Thirty days from when the licence is issued, so open the link when someone is ready to use it.
One automatic trial per organisation
No free tier. A trial is how you prove it on your own data before you buy.
Start here
See your estate as one record.
Request a trial licence, install one Sensor, and follow your first event from the host that saw it to the rule it changed.