KIROSEC
Cost and surprise bills

Investigate logs without paying per gigabyte

The most common complaint about SIEMs and managed detection platforms is the bill: priced per gigabyte ingested, per endpoint or per data source, it grows fastest exactly when an incident sends log volume up. Teams respond by cutting sources and shortening retention, and the evidence is gone when they need it.

How KIROSEC answers it

  • Nothing is metered

    KIROSEC analyses logs on the analyst's own machine. There is no ingest charge, no per-event or per-endpoint fee, and no daily cap that throttles you mid-investigation. A large incident costs the same to analyse as a small one.

  • Bring the evidence, not a pipeline

    Import the exports you already have — EVTX, Sysmon, Linux auth and audit logs, Microsoft 365 and Entra audit exports, CloudTrail, Okta, Google Workspace, firewall and web-server logs — and analyse them as a case. No forwarders, no index to size, nothing to keep running between incidents.

  • Open rules, no lock-in

    The detection rules are plain YAML published under the Apache License 2.0. You can read every rule, take it elsewhere, and judge a finding by its source — not by trust in a vendor's black box.

Where it stops

  • KIROSEC is an investigation tool, not a 24/7 monitoring SIEM: it analyses the logs you give it, it does not collect them continuously.
  • Technical limits apply to every plan alike: 64 GB per imported file and 150 million events per source, and a case needs disk space of roughly twice the logs imported into it (the app checks before an import starts). 1.5 GB of Windows events imports and runs through every rule in about four minutes on a four-core machine, using about 250 MB of memory.

Detections that apply

Browse the full detection library

Questions

Is KIROSEC a cheaper SIEM?
It is a different tool. A SIEM collects and stores logs continuously and bills for that. KIROSEC analyses a set of logs you already have — an incident's exports — on your own machine, so there is nothing to ingest and nothing to meter.
Does analysing more data cost more?
No. KIROSEC is never priced by data volume — there is no per-gigabyte, per-event or per-endpoint charge.

Related problems

See it on your own logs

Bring an incident your current tools struggle with. We will show you how KIROSEC handles it, on your machine, with nothing leaving it.

All problems we solve