LogPulse watches the logs you already collect for signs of an attack. We supply and maintain the detection rules, the agent checks your servers and laptops for software with known vulnerabilities and every alert arrives with a risk score, a first investigation and a plan for handling it. That way your team spends its time on the few alerts that matter.
From loose log lines to one case with a plan, all on the same data.
Raw Logs
12,000 events
Index per type
firewall · iam · dns
Detection Hub
48 detections
Risk Scoring
Per entity, 0–100
Notable
1 critical
Case
Response plan
Reduce noise
From thousands to a handful
Detect faster
Rules we maintain
Correlate smarter
Per device and user
Respond calmly
A case with a plan
From the first alert to the check after an update: everything is in the same product, so the context is ready when your team starts.
An alert for every rule that fires soon becomes a pile nobody reads. LogPulse adds up all signals from one device or user into a score from 0 to 100. You only get an alert above the threshold, so you keep a short list where nothing important gets lost.
The AI Investigator gathers the context, weighs whether it is a real threat or a false alarm and writes down why. If you switch it on, it closes alerts that are certainly harmless by itself. You review the rest and the decision stays with you.
Alerts that belong together come together in one case, with an owner and an agreed response time per severity. For phishing, malware, a taken-over account or a data breach, LogPulse proposes a step-by-step plan, from containing the incident to recovery, including whether you need to report it. That way handling doesn't depend on who happens to be on call that night.
For every vulnerability that matters, the Detection Hub delivers a tested rule, a mitigation and ready-made actions: a ticket with a deadline for your IT team, a block in your firewall, a disabled account or a device taken off the network. LogPulse then checks whether the vulnerability is really fixed. Disruptive steps always wait for an owner.
The LogPulse agent sees which software is on your devices and checks it for known vulnerabilities. In the Detection Hub you see which vulnerabilities affect you, on which devices and what to update first: what is actively exploited comes first. After the update you let the agent check again and the ticket in TOPdesk, Jira or ServiceNow gets a note that it is fixed. You don't need a separate scanner for this.
Which computers still run an old version of a program? Is a port open somewhere that should be closed, or did a firewall rule change? With Live queries you ask all your devices that question at once and see the answer per device. Pick one of 20 ready-made questions or write your own. When you schedule a question, LogPulse keeps track of what changes and you can put an alert on it.
LogPulse learns what is normal for every user and every device. When behavior drifts away from that more and more often, the risk score goes up and you see it while there is still time to step in.
LogPulse AI searches your logs, looks at alerts and cases and makes proposals: a new detection rule, less noise from an existing rule or an action. It works with the same tools Claude or ChatGPT get through the LogPulse MCP server and can only do what you are allowed to do. Every proposal is tested on your own data first. Whether it then waits for approval is up to you.
Why did db-prod-3 get risk 92 last night?
Every source lands in its own index, a fixed place per type of data, such as firewall, iam or dns. Detection rules only search the indexes they need. That keeps searches fast, even with a lot of data, and you see at a glance what is coming in.
New sources get the right index automatically. You can change it per source. Anything that fits nowhere else goes into the main index.
Everything you expect from a full SIEM is in there. On top of that, LogPulse does things you would buy elsewhere as a separate product or extra license, on the same data and in the same subscription.
It all runs on the same storage and search engine as your logs, so there is no separate security database to fill or pay for.
Every server, laptop and user gets a score from 0 to 100. An attack that takes several steps counts for more than noise that keeps repeating. You only get an alert once the score passes a threshold.
Before anyone opens an alert, the AI Investigator has gathered the context and given a verdict, with its reasoning. You open the alert as a workspace with notes, evidence and an overview of what else may be affected.
Alerts that belong together in one case, with an owner and a response time per severity. Five step-by-step plans guide you per type of incident, from containing to reporting.
Over 690 rules from the Detection Hub, mapped to MITRE ATT&CK, the well-known overview of attack techniques. Every rule is tested on a real attack and on normal traffic. You can also write your own rules or import Sigma rules.
The Detection Hub compares the software the agent finds on your devices with lists of vulnerabilities that are actively exploited and delivers a tested rule for each one. Lists of known malicious IP addresses, such as those from abuse.ch and Spamhaus, add context to every alert.
You see which vulnerabilities affect you, on which devices and what to update first. After the update the agent checks again and your service desk gets a ticket for it.
Signing in from two countries within an hour, something happening for the first time or a sudden spike in activity. Small signals like these add up to a finding you won't miss.
A ticket in TOPdesk, Jira or ServiceNow, blocking an IP address in Cloudflare or your firewall, disabling an account in Entra ID or taking a laptop off the network through Defender, CrowdStrike or SentinelOne. Disruptive actions always wait for an owner's approval.
Windows and Linux through the agent, firewalls through syslog and Entra ID, Microsoft 365, Defender, CrowdStrike, SentinelOne, AWS and more through an integration. Everything arrives in the same format, so rules and searches work everywhere.
The SIEM is in every plan, including Free. You start with 1 GB of logs per day, no credit card needed.
Get started