One install on every Linux and Windows machine for logs, vulnerability scanning and Live queries, with server groups and a control plane in the EU. The LogPulse agent builds on Vector, the standard collector, so you keep the runtime you know without managing every host by hand.
Latest version v0.9.4 · Linux and Windows · Read the docs
One install, server groups you can reason about and an EU control plane, wrapped around Vector: the collector you already trust.
One command puts the agent on a Linux or Windows host. It registers itself, joins its group and starts shipping, with no per-machine config to babysit.
Group servers by what they are, pick their inputs from a catalogue, and roll a change to the whole tier at once, from one EU-hosted control plane.
nginxjournaldpostgresqlsyslogfileThe agent wraps Vector, the open, standard collector, so you keep the runtime and VRL you know and skip the fleet-management headache.
VRL transformsyour sourcesyour sinksIf you run Ubuntu, Debian, RHEL, Kubernetes nodes and Windows Servers side by side, you know the pattern: every collector has its own packaging, every host needs its own API key and adding a log source means logging in to every machine. With LogPulse you install the agent once, attach it to a group and every config change rolls out on the next poll.
The agent scans for vulnerabilities itself. It reports the installed software of every server and workstation and runs signed sensors from the Intelligence Hub. LogPulse matches that every hour against known and exploited CVEs, so you see per host which flaws are really open, with the evidence. You do not need Trivy, Grype or another scanner for it.
Evidence per host: package and file version as the agent read them.
The agent reports which software runs: dpkg, rpm and apk on Linux, installed programs, updates and the build number on Windows. LogPulse matches it every hour against the advisories of the distributions and Microsoft, so a backported fix does not linger as a vulnerability.
High-impact CVEs get a sensor in the Intelligence Hub: a fixed question about a package version, file, registry key, process or port that returns hard evidence. New sensors reach your agents by themselves and the agent only runs signed ones.
Sensors only read. There is no script layer and no shell, with fixed limits on time, CPU and files touched. The host keeps an allowlist the server cannot change.
Results feed the same chain as your detection rules: exposure in the Intelligence Hub, a mitigation with a deadline, a ticket in your ITSM and a check afterwards. So "mitigated" shows the flaw is really closed.
Sensors also work when the agent runs without root or administrator rights. What it may not read, it reports as insufficient privilege instead of guessing, so you know where your blind spots are.
Inventory and results go to your own LogPulse environment at a European cloud provider. No CVE database runs on your hosts and nothing goes to a scanner outside the EU.
Software inventory and sensors are on every plan, Free included, and need agent 0.9.1 or later. You find the results per host on the Agents page and per CVE in the Detection Hub. LogPulse does not roll out patches: it shows what is open and proves when it is closed.
How vulnerability scanning worksWant to see it on your own hosts? Book a demo
Is Remote Desktop off everywhere? Which hosts listen on port 3389? What does PasswordAuthentication say in sshd_config? Ask your agents and see the answer per host within seconds. Schedule the question and every change lands in an index, ready for an alert.
The agent answers with the value it read, LogPulse compares it with what you expect.
The question goes straight to the agents over their open connection. Per host you see the value found, or whether it matches what you expect.
Ready-made questions for security, configuration, software and workloads fill the form in one click. Or ask your own about installed software, a registry value, a setting in a config file, a file or a process.
See every listening port per host and the rules of Windows Firewall, ufw or firewalld. A port that opens or a block rule that disappears becomes a change event you can alert on.
Keep a query running every hour, six hours or day. Every change, and once a day the full answer, goes to an index of your choice. Part of Pro and Business.
Live queries use the same read-only building blocks as the sensors. There is no PowerShell, WMI or shell, and paths or keys that look like secrets are refused.
An agent without root or administrator rights answers "Could not check" where it may not read, never "Not found". So a missing answer never looks like a safe one.
Live queries are on every plan and need agent 0.9.3 or later. You find them on the Agents page, tab Live queries.
Run the install script with a short-lived enrollment token: curl on Linux, PowerShell on Windows. It fetches the bundled Vector binary, verifies the checksum, registers the host with the control plane and stores a credential per agent.
Assign the agent to a server group from the UI: prod-edge, staging, db-cluster, whatever you call them. Moving an agent between groups is a one-row update, not a reinstall.
Attach syslog, journald, file, docker or kubernetes inputs to a group. The agent polls every 30 seconds, rewrites its Vector config, and SIGHUPs the runtime: zero log loss, no manual restart.
The latest version for Linux and Windows. The install script is the easiest route; the command with your own token is on the Agents page in LogPulse.
Latest versionv0.9.4
curl -fsSL https://get.logpulse.io | sudo shFor x86_64 and ARM64 with systemd. The script picks the right architecture.
irm https://get.logpulse.io/install.ps1 | iexFor Windows x64 and ARM64 (ARM64 on Windows 11). The script picks the right architecture. Installs the LogPulseAgent service and reads the Windows Event Log and IIS logs.
Rolling out yourself, for example with Ansible, Intune or an image? Download the package for your platform.
Every package has a SHA-256 checksum and a cosign signature (keyless, from GitHub Actions). The install script always checks the checksum, and the signature whenever cosign is on the host. Downloading by hand? Then verify them yourself.
Need a fixed version? Set this for the install script: LOGPULSE_VERSION=v0.9.4
The LogPulse agent doesn't just ship raw lines. We parse each vendor's format and map it onto a shared data model (authentication, firewall, dns, endpoint, security-event) so the same LPQL query works across every source. Below are a handful of the built-in templates; more roll out continuously.
Authentication
SSH login attempts from syslog: source IP, port, user and success/failure extracted from every Accepted and Failed line.
Audit
Linux audit records routed automatically: USER_LOGIN to authentication, SYSCALL/EXECVE to endpoint, everything else to security-event.
Firewall
FortiGate firewall, UTM and event logs split into traffic and security-event records: source/destination IPs, ports, action and policy ID.
Firewall
PAN-OS CSV decoded into firewall (TRAFFIC) and security-event (THREAT) records, including source user, app-id and zone pairs.
Firewall
filterlog CSV parsed into pass/block decisions with full 5-tuple, interface and direction, ready for firewall data-model queries.
Firewall
fleetPage.templates.items.unifi-firewall.description
DNS
DNS queries and blocks from UniFi gateways, OpenWRT and Pi-hole: domain, record type and client IP normalised to the dns data model.
Plus sudo, PAM, iptables/ufw, hostapd and Cisco ASA, with more added continuously. Every parser maps onto the same data model so cross-vendor dashboards just work.
One install script for the major Linux distros and one for Windows. No package repositories to add, no fleet-wide secrets to rotate.
Group hosts the way you already think about them. Attach inputs to groups, not individual hosts.
Enrollment, config polling and heartbeats go through api.logpulse.io at Scaleway in Amsterdam, a European cloud provider. The management path does not cross the US.
Each host gets its own token. Revoke one agent without rotating the rest, audit who shipped what, and move agents between groups without re-enrolling.
Free to start. 1 GB/day, 7-day retention, no credit card. Install the agent on one host today, scale to the whole fleet whenever you're ready.
Create your free account