Security operations platform
LogVeda collects your telemetry, detects with the full Sigma corpus, and gives an analyst a one-click AI investigation that reaches a verdict with cited evidence on the alert they choose. It runs entirely on your own hardware.
Self-hosted · Air-gap capable · Your data never leaves your network
Collection, detection, investigation and response in one deployment, with one data model underneath.
A cyclic reasoning loop over your real telemetry with forensic tools it can call: process ancestry, network sessions, authentication history. It reaches a verdict with cited evidence, and says undetermined rather than guessing.
Sigma-native, with the full public corpus plus rules for Windows, Linux, Active Directory, firewalls, web servers and cloud identity. Coverage is computed at the engine with 24-hour hit counts, so a rule that never matched is a visible gap.
50 playbooks covering the attack classes a SOC actually sees. Containment sits behind an approval gate that genuinely blocks: an approval performs the action, a rejection means nothing happened.
Cases, evidence custody, sign-off, and an audit log that is cryptographically signed. Incidents close through an independent approver, so resolved means somebody accountable said so.
Agents for Windows and Linux, plus 30 source parsers: Event Log, ETW, auditd, journald, eBPF, M365, Entra, Okta, AWS, Azure, GCP, firewalls, proxies, DNS, EDR, email and more.
Everything becomes OCSF, so a rule written once matches across every source.
Sigma, correlation, sequence and behavioural rules run in-stream.
The AI layer assembles the case with evidence, ATT&CK mapping and a verdict.
Playbooks act, gated by approval, and the case records what was done.
Every tier is a self-hosted deployment. The ceilings are the ones the product enforces, read from the same table that signs your licence key. A lapsed licence drops to Community and keeps running - it never goes dark.
Evaluate the detection engine on a real network.
1,000 events/sec with a free registered key (the 5-agent cap is the Community tier)
A working SOC: response, ticketing and threat intel included.
Unlimited ingest, the AI layer, and multi-tenant operation.
If a licence lapses, the SIEM keeps running. The deployment falls back to Community entitlements (500 events/sec) and carries on collecting, detecting and alerting. Your events, rules, cases and evidence stay exactly where they are.
No. LogVeda runs entirely on your own hardware and works air-gapped. The optional outbound connections can each be switched off.
Monitoring keeps running. The deployment falls back to the free Community limits and your events, rules, cases and evidence stay where they are.
Free the old seat yourself at Free a seat, then activate the new deployment with the same key.
Yes. Community Edition is free with no time limit, and a 30-day Enterprise evaluation licence is available - get a key.
Tell us what you are running and what you need to see. We will come back with a scoped deployment and a licence quote. sales@cyberlynk.in · CyberLynk LLP.