Log analysis with no cluster to run
Free and self-hosted tools trade licence cost for labour: indexers that time out, upgrades that break, Docker stacks with memory floors, and a server that has to exist before the first log can be read. For an incident that started an hour ago, that is the wrong order of work.
How KIROSEC answers it
A desktop app, not an infrastructure project
Install KIROSEC on Windows or Linux, create a case, drop in the logs. Parsing, detection, the timeline and the case store all run locally. There is no service to keep alive between incidents.
Works with no network at all
The Offline Edition is built without networking code — no HTTP client, no TLS library, no DNS resolver — so it can be used on air-gapped and classified networks, and your own security team can verify that from the dependency tree.
Rules update without a reinstall
Detection rules and knowledge ship as signed, versioned packs. In an air-gapped environment they are side-loaded like any other file.
Where it stops
- macOS installers are not available yet; Windows and Linux are.
- Preview installers are unsigned, so Windows SmartScreen asks for confirmation on first run.
- The managed console for MSPs (central case sync and fleet view) is a hosted service and needs the Connected Edition.
- A local case uses roughly twice the disk space of the logs imported into it, so very large collections need room on the analyst's machine.
Detections that apply
Browse the full detection libraryQuestions
- Do I need Docker, Elasticsearch or a database server?
- No. KIROSEC stores each case in a local database file and needs nothing else running.
- Can I use it on an air-gapped network?
- Yes. The Offline Edition contains no networking code, and rule packs and models are side-loaded.
Related problems
See it on your own logs
Bring an incident your current tools struggle with. We will show you how KIROSEC handles it, on your machine, with nothing leaving it.