Frequently asked questions.

LogSeam is the agentic SOC platform. An open security data lake, the Lake, stores all your security logs as open Parquet in your own bucket, and the platform on top runs your entire SOC: detection-as-code, AI agents that triage and investigate every alert, structured incident response, and real-time dashboards. One system, from raw logs to closed cases.

LogSeam is built for security teams of all sizes, from lean two-person SOCs to enterprise security operations centers. If you're drowning in SIEM costs, struggling with alert fatigue, or running incident response on spreadsheets and Slack, LogSeam was built for you.

Most teams are ingesting data within hours. Connect your first source, and you'll see logs flowing into the lake immediately. Detection rules can be deployed the same day. A broader rollout typically takes one to two weeks: tuning rules, building dashboards, and training your team.

Yes. The Lake works as standalone security data storage: open Parquet in your bucket, queryable with your own tools. You can adopt detection, triage, and the agent fleet whenever you're ready. The platform requires the Lake as its data backend; the Lake doesn't require the platform.

Detection-as-Code means your detection rules are written in Sigma/YAML, the open vendor-agnostic standard, not locked in a proprietary format. You can version control them, test them against real data before deploying, and share them across teams. LogSeam supports five rule types: Sigma, behavioral, statistical, graph analysis, and ML/AI.

When a detection rule fires, AI pre-assesses the alert with a verdict (benign, suspicious, or malicious), a confidence score, risk assessment, and extracted IOCs. It can enrich indicators against sources like VirusTotal, AbuseIPDB, IPinfo, and URLScan, all in parallel, so analysts start with context instead of a blank alert.

Absolutely. Author rules in Sigma/YAML or write SQL directly. The editor shows a live SQL preview of your Sigma rule so you see exactly what will execute. Classify by MITRE ATT&CK, set severity, and add metadata. Test rules against real data before promoting them to production, with quality gates for precision and false-positive targets.

Five report types, all AI-assisted: executive reports for your CISO and board, compliance reports mapped to SOC 2/ISO 27001/HIPAA, incident reports with full timelines and IOC inventories, technical reports with rule performance and ATT&CK coverage, and custom reports that mix sections from any type.

Spaces are infinite, zoomable investigation canvases. Drag widgets onto the canvas: search results, timelines, MITRE ATT&CK matrix, entity cards, enrichment data, and correlation maps. An AI copilot sees your entire canvas, suggests next queries, enriches IOCs, and generates investigation findings. Multiple analysts collaborate in real time with live cursor tracking.

Yes. AES-256 encryption at rest and TLS 1.3 in transit. Role-based access control with SSO/SAML support. Full audit trails for every action. Your data lives in your own object storage. LogSeam processes it but never takes custody of it.

LogSeam generates compliance reports mapped to SOC 2, ISO 27001, and HIPAA. Detection coverage is mapped to MITRE ATT&CK tactics and techniques. The platform captures analyst action audit trails for compliance evidence, reducing the manual prep needed for recurring reports.