Scale, federation, evidence that stands up in a legal matter, and a license that does not tax you for visibility.
At enterprise scale the logging bill stops being a line item and starts being the thing that decides your security posture. What you are allowed to see is settled in a budget conversation.
CAVER removes that constraint by charging per deployment rather than per gigabyte, and by putting the data in your own storage in an open format. On top of that: five capabilities on one store, federation with what you already run so migration is measured rather than assumed, and evidence with cryptographic custody that an opposing expert can verify without touching your systems.
Where incumbents still win is stated in here too, because at this size the switching costs are real and pretending otherwise wastes everybody's time.
The problems change shape at size, and most of them are economic rather than technical.
CAVER charges a flat fee per deployment. There is no charge per gigabyte.
That is a pricing decision, but it only works because of how the system is built. On a storage lake, what a search costs depends on how many files it opens, not how many bytes you have kept. CAVER continuously merges small files into fewer, larger, sorted ones.
On a real production system running about 100GB a day, that change did two things:
Older data moves to a sealed tier that is simply a folder. Months outside your search window are never opened at all. There is no separate index to rebuild before a search or an alert can reach that folder: detections and dashboards query it directly, measured at 172 milliseconds for an alert and 76 milliseconds for a dashboard panel over a million events.
What this means for you: "how far back can I search" becomes a storage question, not a performance question. You stop choosing between logging everything a regulator or an investigation might ask about and staying inside budget.
A suite of five tools on a single data store. Not four products bolted together, and not four contracts.
| Layer | What it does |
|---|---|
| SIEM core | Search and alerting. Eight query languages (SPL, SQL, KQL, ES|QL, LSQL, Sigma, PromQL and LogQL), plus an AI assistant as a ninth way to ask. |
| CAVERN | The detection content: more than 400 ready-made vendor packs and 5,000+ rules, mapped to the SigmaHQ open rule standard and tagged to MITRE ATT&CK, so your coverage is expressed in terms an auditor and a peer organization both recognize. Includes an editor that back-tests a new rule against your real history before you turn it on. |
| ECHO | Service monitoring: what is up, what is degraded, what depends on what. |
| UBA | 65+ behavior models that need no training data. Off-hours activity, unusual access, lateral movement. |
| SLAM | Case management and response, with approval gates. Paired with the Evidence Locker. |
To spot a pattern you have to know it is the same subject. To be safe, you would rather not hold their name. CAVER does both, converting the identifier into a salted one-way key:
It shrinks what a compromise of CAVER itself would cost you. A security tool that has quietly accumulated a second copy of your sensitive identifiers is a second breach waiting to be reported, and it is the question a thorough procurement process will ask.
The riskiest part of replacing a SIEM is the part nobody can test in advance. So do not replace it first.
Almost all of this works the day your data lands. One part does not, and it is worth being exact about which part, because the difference is usually explained badly.
That last point is the one that matters. "We found nothing" and "we are not ready yet" look identical on a screen, and only one of them is good news. A tool that does not distinguish them is quietly telling you that you are safe during the exact period it cannot tell.
Search runs through Trino or the native engine, with a per-search cost row and a Query Insights page, so you see which searches cost what. Per-group search budgets queue work instead of refusing it, and a reserved top-priority lane keeps incident searches running under load. Federation pushes partial aggregation down to each peer and can skip a peer that is unavailable instead of failing the whole search.
The Iceberg catalog is served by CAVER itself through an exported REST interface, so other engines can query the same tables. That is what "no lock in" looks like when you test it.
The reason teams turn detections off is not that the detections are wrong. It is that nobody is left to work the output.
Roughly a third of alerts are never investigated, an investigation takes over an hour, and an analyst closes twenty to thirty in a shift. A three-digit queue does not fit inside a staffed team by arithmetic. So CAVER ships named workers rather than more alerts: each one holds a single job, runs it on its own beat, and reports what it found.
An agent that speaks only when it finds something is indistinguishable from one that is broken, and the second is far more common than anyone admits. Every run is written down whether or not it found anything, carrying what it checked and over what window. A quiet morning becomes evidence rather than an absence of evidence.
Twenty of the thirty-six are rules, joins and thresholds: the same data gives the same answer on any day, and it can be explained to an auditor as a query. The other sixteen are baselines, peer groups and rarity, which is still arithmetic over your own history. Five can use a language model to write their summary in prose; turn it off and you lose the wording, not the finding.
Eleven platform agents look after the deployment itself, which at your scale is the half nobody staffs: a source that stopped sending, a rule that has gone noisy, a trust about to expire, coverage that has quietly rotted. Three more watch the identities that are not people: service accounts, API keys and OAuth applications still holding grants nothing has been observed using, entitlements that have drifted past what is exercised, and static credentials older than their sensitivity allows. Each of those fails loudly when its feed is not connected, because an unwired inventory and a clean estate look identical otherwise.
Every agent ships disabled, and you enable them one at a time from the product. That is deliberate. At enterprise scale the wrong default is the expensive one, so the roster starts silent and you widen it deliberately.
The workforce, the roster and the controls are shipped and in the product. The connections that feed individual agents land per data source, so an agent whose source is not connected yet says exactly that and names what it needs, rather than reporting a confident nothing. Ask us which of the thirty-six are live against your feeds before you count on any one of them.
Most estates buy endpoint telemetry from somewhere, and CAVER reads what you already run: CrowdStrike, Defender, SentinelOne, Sysmon, syslog and the forwarders on your servers. For the hosts where the options are bad, CAVER ships its own agent, Carbide, at no extra charge.
Sysmon process, network, file, registry, module-load, DNS and memory events all arrive as OCSF with the parent and child identifiers carried in the event, so a chain of executions joins across hosts rather than only inside one log line. A coverage screen shows which Event IDs are arriving now, which were seen in the last week and not in the last day, and which hosts are reporting. Every freshness figure is the time of the last event, never a count, because a count is satisfied by history: a source that died last week still has a large one.
| Same host, same workload | Kernel capture | Polling |
|---|---|---|
| 300 short-lived processes in a loop | 300 captured | 0 captured |
That row is why the agent exists. A process that starts and exits between two polls is most of what execution telemetry is for, and a poller cannot see it.
Carbide ships for Linux, Windows and macOS, installed as a system service. AIX coverage is available to design partners. Where you already run CrowdStrike, Defender or SentinelOne, Carbide sits beside it or CAVER reads that instead. Sysmon process, network, file, registry, module-load, DNS and memory events are all normalized to OCSF and addressed by the same detection content.
On Windows, Carbide reads process launches, per-process network connections, driver loads with SHA-256 hashes, file and registry changes, service installs and credentials left in command lines. On macOS it uses Apple's EndpointSecurity framework, with ten ready-made panels and detections.
In interactive mode, a response channel on a separate authenticated path can kill a process by identity, quarantine a file into custody with its hash, isolate a host with nftables and collect files or event logs. Every action is signed and recorded. Read-only mode leaves it off. Kill and isolate on Windows and macOS are available to design partners.
The questions an architecture review and an auditor ask in the same week.
Available to design partners: a clustered CAVER with a stateless query tier and a lake-resident result cache, Carbide Console with SSO and SCIM groups, rollout rings, execution control and recovery-key escrow, and one committable caver.yaml with a drift hash. Available on request, typically delivered within 30 days of order: agent certificates issued by CAVER at enrollment with mTLS to the deployment server, CAVER as a subordinate CA under your own PKI, scheduled report delivery, and a lookup store with access control.
Real measurements from a production system handling about 100GB per day.
| Search | Time |
|---|---|
| Empty hour | 6 ms |
| One hour of data | 38 ms |
| 24 hours of data | 453 ms |
| 48 hours across two data centers | 627 ms |
Published figures show searches under 50 ms at the 95th percentile. The counterpart matters just as much: a 120-second ceiling still applies to large summarized searches, and searches over recent data under load run around 1.1 to 1.2 seconds. We are working on that ceiling. Both numbers are published because a best case is not a guarantee.
Ask any vendor, including us, for the range across your own data types during a trial. Not just one blended figure.
A vulnerability list ranked by severity score tells you what could be exploited. Two public feeds tell you what is.
CAVER ingests CISA's Known Exploited Vulnerabilities catalog, about 1,200 CVEs with confirmed exploitation, and FIRST's EPSS scores, an exploitation probability for roughly 200,000 CVEs, every day, and joins both onto your findings by CVE. The vulnerability screen gains an exploited-in-the-wild filter and a sortable probability column.
The effect on a real board is the difference between "4,000 findings" and "these eleven are being exploited right now, start here".
In 2026 CISA published an advisory in which two organizations faced the same red team with the same tradecraft and both fell to full domain compromise. One isolated three phished workstations in 10, 2 and 20 minutes and cut the command channel. The other actioned zero alerts. The difference was not the tooling and not the detection content; it was how fast a person acted on what the tooling already knew.
So CAVER measures that interval, per incident, from the case record:
We publish compression and query speed as first-class numbers because they are how CAVER beats a per-gigabyte platform. Time to contain is the number that decides whether any of that mattered, and it is on the same screen.
| Area | Typical SIEM | CAVER |
|---|---|---|
| Pricing | Per gigabyte; retention becomes a budget lever | Flat per deployment |
| Data ownership | Often vendor-hosted, proprietary format | Your storage, your keys, open format |
| Archived data access | A restore or rehydration job, often billed per query | Queried directly from your own bucket, no restore step |
| Encryption at rest | Assumed, rarely verified | Checked before start; refuses to run on storage it cannot confirm |
| Federation | Usually migrate-or-nothing | Splunk search peer, or federate with four others |
| Detection content | Bought separately or written by you | More than 400 vendor packs mapped to SigmaHQ and MITRE ATT&CK, with backtesting |
| Your existing detection content | A rewrite, or left behind | Sigma, Splunk, Elastic, Sentinel, QRadar and Defender rules convert in, with a report on what did not |
| Evidence handling | Export logs; chain of custody is manual | Cryptographic custody, verifiable offline |
| Compliance reporting | Usually a separate product | More than 20 frameworks built in, signed export |
| Where it runs | Many are cloud only | Cloud, on-premise, air-gapped, single box |
An established SIEM has real advantages we will not pretend away:
Those are genuine switching costs. Our answer is the parallel-run and collector-only options above, which let you measure the difference instead of taking it on faith.
In August 2026 CISA published a Logging Reference Architecture implementing OMB memorandum M-26-14. It is not a list of sources to collect. It asks whether a logging capability can be shown to still be working, and it names the failure modes that make a healthy-looking estate useless.
| CISA asks for | CAVER |
|---|---|
| 4.7 Detect coverage gaps and delivery failures even when systems appear to be functioning | A source that goes quiet is a finding, not a quiet week. Agents heartbeat on the channel they ship on, and the coverage screens report last-seen time per source rather than a count. |
| 6.2.5 Endpoint records with process context rich enough for lateral-movement analysis and timeline reconstruction | Process lineage is part of the event contract, from Sysmon and from Carbide, so a chain joins across event types. |
| 7.1, 7.2 Durable normalization, with source-native context preserved | The raw event is kept and the normalized class is a layer over it, applied on the way in. Every event names the normalizer and version that produced its view. |
| 8.2 Integrity at collection, in transport, in storage and during access | The Evidence Locker: hashed on arrival, an append-only transparency ledger, signed export, verifiable offline by someone who does not trust us. |
| 4.5 Separate actively searchable data from lower-cost retrievable tiers, and decide how long each stays searchable | Set per index, and re-measured in the product. 48:1 compression (raw log volume against what the lake stores) is what decides whether the answer is a year or ninety days. |
The full mapping, in CISA's numbering, is at getcaver.com/cisa-logging. The most useful version of the conversation is section by section against your estate, including the parts where the answer is that you have work to do.
It is a reading of a public document against a product, done by the product's vendor. It is not an endorsement, a certification or a relationship with CISA, and nothing here should be read as one.
A built-in report maps your estate to OMB M-26-14 and the CISA performance goals. For BOD 26-04 it carries a remediation clock, a deadline table and a seven-day asset report, and CISA Vulnrichment SSVC decision points join KEV and EPSS on each finding.
For the moment an incident becomes a legal, regulatory or contractual matter.
At that point someone outside your security team needs to trust the record without trusting your vendor. The Evidence Locker is built for that:
What this means for you: the difference between "we have logs" and "we have a record an investigator, an opposing expert or a cyber-insurance carrier can independently verify."
The AES-256 password protects the contents of the archive. The list of file names and their sizes is still readable without the password, which is how the ZIP format works. If a file name would itself reveal something, rename it before export.
Legal hold is dual-authorized, with S3 Object Lock WORM storage, Ed25519 timestamps and a signed PDF exhibit export.
AI assistants are already inside most organizations, usually before anyone counted them.
Microsoft Agent 365 registers every AI agent and sets what it is allowed to touch, at sign-in. It answers who an agent is. CAVER reads that same event data and watches behavior over time, and also covers the tools Microsoft never sees: Claude, Cursor, Codex, Copilot, OpenAI and others.
What is included: 24 content packs and over 200 rules, covering prompt manipulation, data leaving through an AI tool, misuse of connected tools, and runaway automation.
CAVER can also sit in front of your AI traffic as a checkpoint, with a full audit trail, per-user limits and blocking of unapproved AI services. An employee pasting customer data into an unapproved model provider becomes a recorded, scored event rather than something nobody sees.
We have no published CAVER-specific measurement for the delay this adds. It is one extra step in the request path, which is small next to the one-to-six seconds an AI request already takes. Ask us for a firm number before relying on it for a decision.
Telemetry from Claude Code, Codex, Cline, Cursor and Warp transcripts is read, a nightly LLM-as-judge grades rule quality, and an agent-attack coverage matrix shows what is and is not detected. CAVER's own MCP server gives agents capability-scoped, audited, signed read access.
One product, not a different tool for every environment.
CAVER runs on Kubernetes, a virtual machine, an isolated network, or a single box. License activation does not need an internet connection, and a lapsed license gives you a 14-day grace period rather than shutting off mid-incident.
This is your risk decision. Both are real products. Neither is a discouraged version of the other.
SAML 2.0 and OpenID Connect are both configured in the product: paste or fetch your identity provider's SAML metadata, or point at your OIDC issuer for discovery, then map the attributes or claims to roles. Test against the live provider before you can turn it on: enable is refused without a successful test in the last 24 hours. A saved change or a disable takes effect on the next request, no restart, and local login stays reachable so an identity-provider outage cannot lock your operators out. An OIDC client secret is sealed in the product's credential vault, never stored in the clear.
SCIM provisioning is configured the same way: an operator mints a bearer token for the identity provider, shown once and stored only as a hash, revoked on the very next request rather than the next restart. Group membership from SAML, OIDC, or SCIM maps to roles by the same rule.
Two different questions: systems that send us logs, and equipment watched on the network.
| Category | How it reaches CAVER | Status |
|---|---|---|
| Cloud platforms | Native audit trails from AWS, Azure, Google Workspace, Microsoft 365, Cloudflare | Ready-made packs |
| Endpoints and network | EDR, Sysmon, firewalls, VPN, DNS, proxies | Ready-made packs |
| Carbide, our own endpoint agent | Kernel-level process telemetry on Linux, Windows and macOS, shipped to CAVER directly | Included; AIX for design partners |
| Exploitation feeds | CISA KEV and FIRST EPSS, joined onto findings | Ingested daily |
| Identity | Entra ID, Okta, Active Directory, Duo | Ready-made packs |
| Industrial equipment | More than a dozen industrial protocols decoded passively from mirrored traffic | Included, no extra product |
| AI tools | Microsoft Agent 365 event data, plus Claude, Copilot, OpenAI and others | 24 packs, 200+ rules |
More than 400 ready-made vendor packs ship for the common systems, so the bespoke work is the exception rather than the starting point.
Dragos, Claroty, Nozomi, Armis, Forescout, Tenable OT and Defender for IoT feed in, and ServiceNow, Jira and PagerDuty receive cases. Existing agents work unchanged: Splunk HEC and Universal Forwarders, Elastic Beats, OpenTelemetry, Prometheus remote-write, Kafka, Kinesis and Windows Event Forwarding. Fifteen open threat feeds ship enabled. Commercial feeds such as Recorded Future, Mandiant and CrowdStrike Intel connect with your own subscription, delivered on request.
A trial is 60 days, $25K to $75K, credited fully toward your first year if you proceed. If you are replacing Splunk, a displacement credit of 25% to 50% off year one is available separately.
Do not take this paper on faith. Test it directly: