Platform / Layer 1
Layer 1 · the floor
Everything that happened, in one shape, before anything argues about it.
Most security disagreements are not analytical. They are two products holding two different copies of the same afternoon, each with its own timestamps, its own idea of which host is which, and its own gaps. This layer exists so that argument never starts.
Watch it happen · authored example
Five dialects in. One shape out.
Each line arrives in its own format. Each leaves with the same field names, a seal, and two clocks: when it happened, and when we first saw it.
Five log lines from five different formats (nginx, Windows, a cloud audit record, syslog and CEF) become five records with the same fields, each sealed and chained to the one before. Alter one and its seal fails, and the next link no longer matches.
The argument
A log line is a sentence somebody's software wrote for its own purposes. An event is that sentence turned into a fact the whole platform can reason about: decoded, given the same field names as everything else, tied to a known machine and identity, sealed so it cannot be quietly edited afterwards, and stamped with when it was actually seen rather than when it was filed.
Everything above this layer — every detection, every graph walk, every report that leaves the building — is standing on that one transformation. Get it wrong and the floors above are confidently wrong. Get it right once and you never pay for it again.
Everything above this layer — every detection, every graph walk, every report that leaves the building — is standing on that one transformation. Get it wrong and the floors above are confidently wrong. Get it right once and you never pay for it again.
One line, followed through
A worked example. This is authored teaching material, not a customer's data.
2026/08/24 11:02:14 [error] 2841#0: *17 connect() failed (111) upstream "127.0.0.1:9000"
decoded
The format is recognised and pulled apart into parts with names — a severity, a process id, an upstream address — rather than kept as a string somebody will write a regular expression against later.
normalised
Those parts become the same field names a firewall log, a cloud audit trail and a SaaS sign-in use. This is what makes a question like what else touched this address answerable at all, rather than a project.
sealed
The event gets a fingerprint. If anyone alters it later, including us, the alteration is detectable — which is the difference between evidence and a record you are asked to trust.
stamped
Two times are kept: when it happened on the machine, and when we first saw it. They differ whenever a network was slow or a host was offline, and a platform that keeps only one of them cannot tell a late event from a quiet hour.
Scope & Honest Limits The honest limits Expand · Full ledger →
Every layer of this platform has things it cannot see or cannot judge. We publish them, because the alternative is you discovering them during an incident.
A machine with no agent is not a quiet machine
It is an unobserved one, and the platform draws those two states differently everywhere. Nothing here infers safety from silence.
We cannot normalise a field a source never sent
An absent field stays absent rather than becoming a zero or a default. Boards above will say a value was never stamped instead of inventing one.
Sealing proves integrity, not truthfulness
If a compromised host lies to us, we can prove nobody altered the lie after it reached us. We cannot make it true.
Retention is a budget, and it is yours
Questions that reach past your retention window have no answer here. We would rather say that plainly than return a confident partial one.
What this layer deliberately does not do
It does not decide anything. No detection logic, no severity, no verdict about whether something matters — those belong one floor up, where the context to judge them lives. A layer that both collected evidence and ruled on it would have no independent record left to check the ruling against.
It also does not drop what it cannot classify. An event of an unfamiliar kind is kept in the shape it arrived in rather than discarded for being inconvenient.
It also does not drop what it cannot classify. An event of an unfamiliar kind is kept in the shape it arrived in rather than discarded for being inconvenient.
Words this page introduced
Full glossary →Event — one thing that happened, in the platform's own shape. The unit everything else is built from.
Normalising — giving events from different products the same field names, so one question can span all of them.
Sealing — fingerprinting an event so later alteration is detectable.
The agent — one program on a machine doing the work several products used to each install separately.
This layer's capabilities
All 88 →
The agent
included
Integrations
included · browse all 138 sources
Event store and search
by volume
Retention and legal hold
by volume
Continuous export
included
Source health and gaps
included
Charging shows how a capability is metered, not a price. Prices are published when a line is generally available.
Next floor up
Making sense of it
Nothing above this floor is allowed to see anything this floor did not record. That is the constraint that makes the rest of the platform checkable — and it is where the graph you can walk lives.