A cybersecurity suite on a single data store, with a SIEM at its core. It does not charge by the gigabyte, does not hold your data hostage, and tells you where it stops.
Most security programs are shaped by their logging bill rather than by their risk. The SIEM charges by volume, so retention gets cut and log sources get dropped, and the platform that should answer "what happened, when, and who touched it" quietly stops seeing everything.
CAVER charges a flat fee per deployment and stores your data in your own storage in an open format. That combination is what makes the rest possible: five capabilities on one store instead of four products, retention measured in years rather than budget, and a platform you can leave without losing your history.
This paper describes what it is, what it measures, where the incumbents still win, and what CAVER does not do. Every performance figure comes with the method and the ceiling, because a number without either is a claim rather than a measurement.
Most security tools charge by the gigabyte. Modern estates produce a lot of gigabytes.
So the same thing happens everywhere:
That is not bad luck. It is the predictable result of paying by volume.
Most organizations run four separate products: a SIEM, a behavior tool, a response tool and a compliance tool. Each is licensed and integrated on its own schedule. Incidents live longest in the gaps between them.
CAVER charges a flat fee per deployment. There is no charge per gigabyte.
That is a pricing decision, but it only works because of how the system is built. On a storage lake, what a search costs depends on how many files it opens, not how many bytes you have kept. CAVER continuously merges small files into fewer, larger, sorted ones.
On a real production system running about 100GB a day, that change did two things:
Older data moves to a sealed tier that is simply a folder. Months outside your search window are never opened at all. There is no separate index to rebuild before a search or an alert can reach that folder: detections and dashboards query it directly, measured at 172 milliseconds for an alert and 76 milliseconds for a dashboard panel over a million events.
What this means for you: "how far back can I search" becomes a storage question, not a performance question. You stop choosing between logging everything the business needs logged and staying inside budget.
A suite of five tools on a single data store. Not four products bolted together, and not four contracts.
| Layer | What it does |
|---|---|
| SIEM core | Search and alerting. Eight query languages (SPL, SQL, KQL, ES|QL, LSQL, Sigma, PromQL and LogQL), plus an AI assistant as a ninth way to ask. |
| CAVERN | The detection content: more than 400 ready-made vendor packs and 5,000+ rules, mapped to the SigmaHQ open rule standard and tagged to MITRE ATT&CK, so your coverage is expressed in terms an auditor and a peer organization both recognize. Includes an editor that back-tests a new rule against your real history before you turn it on. |
| ECHO | Service monitoring: what is up, what is degraded, what depends on what. |
| UBA | 65+ behavior models that need no training data. Off-hours activity, unusual access, lateral movement. |
| SLAM | Case management and response, with approval gates. Paired with the Evidence Locker. |
To spot a pattern you have to know it is the same subject. To be safe, you would rather not hold their name. CAVER does both, converting the identifier into a salted one-way key:
It shrinks what a compromise of CAVER itself would cost you. A security tool that has quietly accumulated a second copy of your sensitive identifiers is a second breach waiting to be reported, and it is the question a thorough procurement process will ask.
The five layers above are the headline. These are the pieces that tend to decide a first week.
Reports map controls to evidence for NIST CSF 2.0, 800-53 and 800-171, CIS v8, PCI DSS 4.0, SOC 2, ISO 27001:2022, the HIPAA Security Rule, DORA, NIS2, IEC 62443, NERC CIP, the CISA performance goals and more. Each report is generated on demand, signed, and shows its evidence rows.
The reason teams turn detections off is not that the detections are wrong. It is that nobody is left to work the output.
Roughly a third of alerts are never investigated, an investigation takes over an hour, and an analyst closes twenty to thirty in a shift. A three-digit queue does not fit inside a staffed team by arithmetic. So CAVER ships named workers rather than more alerts: each one holds a single job, runs it on its own beat, and reports what it found.
An agent that speaks only when it finds something is indistinguishable from one that is broken, and the second is far more common than anyone admits. Every run is written down whether or not it found anything, carrying what it checked and over what window. A quiet morning becomes evidence rather than an absence of evidence.
Twenty of the thirty-six are rules, joins and thresholds: the same data gives the same answer on any day, and it can be explained to an auditor as a query. The other sixteen are baselines, peer groups and rarity, which is still arithmetic over your own history. Five can use a language model to write their summary in prose; turn it off and you lose the wording, not the finding.
The roster covers three areas: eleven platform agents that look after the deployment itself (a source that stopped sending, a rule that has gone noisy, a certificate about to expire), nineteen clinical, and six for utility and industrial work.
Every agent ships disabled, and you enable them one at a time from the product. That is deliberate. An agent that switched itself on at install would spend its first week reporting your normal day shift, and nobody gives it a second week.
The workforce, the roster and the controls are shipped and in the product. The connections that feed individual agents land per data source, so an agent whose source is not connected yet says exactly that and names what it needs, rather than reporting a confident nothing. Ask us which of the thirty-six are live against your feeds before you count on any one of them.
Most estates buy endpoint telemetry from somewhere, and CAVER reads what you already run: CrowdStrike, Defender, SentinelOne, Sysmon, syslog and the forwarders on your servers. For the hosts where the options are bad, CAVER ships its own agent, Carbide, at no extra charge.
Sysmon process, network, file, registry, module-load, DNS and memory events all arrive as OCSF with the parent and child identifiers carried in the event, so a chain of executions joins across hosts rather than only inside one log line. A coverage screen shows which Event IDs are arriving now, which were seen in the last week and not in the last day, and which hosts are reporting. Every freshness figure is the time of the last event, never a count, because a count is satisfied by history: a source that died last week still has a large one.
| Same host, same workload | Kernel capture | Polling |
|---|---|---|
| 300 short-lived processes in a loop | 300 captured | 0 captured |
That row is why the agent exists. A process that starts and exits between two polls is most of what execution telemetry is for, and a poller cannot see it.
Carbide ships for Linux, Windows and macOS, installed as a system service. AIX coverage is available to design partners. Where you already run CrowdStrike, Defender or SentinelOne, Carbide sits beside it or CAVER reads that instead. Sysmon process, network, file, registry, module-load, DNS and memory events are all normalized to OCSF and addressed by the same detection content.
On Windows, Carbide reads process launches, per-process network connections, driver loads with SHA-256 hashes, file and registry changes, service installs and credentials left in command lines. On macOS it uses Apple's EndpointSecurity framework, with ten ready-made panels and detections. CAVER also reads Carbon Black, Cortex XDR, Trellix, Trend Micro, Sophos, Huntress, Jamf, Wazuh, osquery and Falco.
Carbide can act as well as watch, in the install mode you choose. A response channel on a separate authenticated path can kill a process by identity, quarantine a file into custody with its hash, isolate a host with nftables and collect files or event logs. Every action is signed and recorded. Read-only mode leaves the response channel off.
Available to design partners: kill and isolate actions on Windows and macOS hosts. Available on request, typically delivered within 30 days of order: Carbide for Windows laptops, with a signed MSI and Intune or Group Policy enrollment.
Real measurements from a production system handling about 100GB per day.
| Search | Time |
|---|---|
| Empty hour | 6 ms |
| One hour of data | 38 ms |
| 24 hours of data | 453 ms |
| 48 hours across two data centers | 627 ms |
Published figures show searches under 50 ms at the 95th percentile. The counterpart matters just as much: a 120-second ceiling still applies to large summarized searches, and searches over recent data under load run around 1.1 to 1.2 seconds. We are working on that ceiling. Both numbers are published because a best case is not a guarantee.
Ask any vendor, including us, for the range across your own data types during a trial. Not just one blended figure.
A vulnerability list ranked by severity score tells you what could be exploited. Two public feeds tell you what is.
CAVER ingests CISA's Known Exploited Vulnerabilities catalog, about 1,200 CVEs with confirmed exploitation, and FIRST's EPSS scores, an exploitation probability for roughly 200,000 CVEs, every day, and joins both onto your findings by CVE. The vulnerability screen gains an exploited-in-the-wild filter and a sortable probability column.
The effect on a real board is the difference between "4,000 findings" and "these eleven are being exploited right now, start here".
In 2026 CISA published an advisory in which two organizations faced the same red team with the same tradecraft and both fell to full domain compromise. One isolated three phished workstations in 10, 2 and 20 minutes and cut the command channel. The other actioned zero alerts. The difference was not the tooling and not the detection content; it was how fast a person acted on what the tooling already knew.
So CAVER measures that interval, per incident, from the case record:
We publish compression and query speed as first-class numbers because they are how CAVER beats a per-gigabyte platform. Time to contain is the number that decides whether any of that mattered, and it is on the same screen.
| Area | Typical SIEM | CAVER |
|---|---|---|
| Pricing | Per gigabyte; retention becomes a budget lever | Flat per deployment |
| Data ownership | Often vendor-hosted, proprietary format | Your storage, your keys, open format |
| Archived data access | A restore or rehydration job, often billed per query | Queried directly from your own bucket, no restore step |
| Encryption at rest | Assumed, rarely verified | Checked before start; refuses to run on storage it cannot confirm |
| Query languages | One, usually the vendor's own | Eight, including Splunk's SPL, plus an AI assistant |
| Detection content | Bought separately or written by you | More than 400 vendor packs, mapped to SigmaHQ and MITRE ATT&CK |
| Your existing detection content | A rewrite, or left behind | Sigma, Splunk, Elastic, Sentinel, QRadar and Defender rules convert in, with a report on what did not |
| Evidence handling | Export logs; chain of custody is manual | Cryptographic custody, verifiable offline |
| Compliance reporting | Usually a separate product | More than 20 frameworks built in, signed export |
| Where it runs | Many are cloud only | Cloud, on-premise, air-gapped, single box |
An established SIEM has real advantages we will not pretend away:
Those are genuine switching costs. Our answer is the parallel-run and collector-only options above, which let you measure the difference instead of taking it on faith.
In August 2026 CISA published a Logging Reference Architecture implementing OMB memorandum M-26-14. It is not a list of sources to collect. It asks whether a logging capability can be shown to still be working, and it names the failure modes that make a healthy-looking estate useless.
| CISA asks for | CAVER |
|---|---|
| 4.7 Detect coverage gaps and delivery failures even when systems appear to be functioning | A source that goes quiet is a finding, not a quiet week. Agents heartbeat on the channel they ship on, and the coverage screens report last-seen time per source rather than a count. |
| 6.2.5 Endpoint records with process context rich enough for lateral-movement analysis and timeline reconstruction | Process lineage is part of the event contract, from Sysmon and from Carbide, so a chain joins across event types. |
| 7.1, 7.2 Durable normalization, with source-native context preserved | The raw event is kept and the normalized class is a layer over it, applied on the way in. Every event names the normalizer and version that produced its view. |
| 8.2 Integrity at collection, in transport, in storage and during access | The Evidence Locker: hashed on arrival, an append-only transparency ledger, signed export, verifiable offline by someone who does not trust us. |
| 4.5 Separate actively searchable data from lower-cost retrievable tiers, and decide how long each stays searchable | Set per index, and re-measured in the product. 48:1 compression (raw log volume against what the lake stores) is what decides whether the answer is a year or ninety days. |
The full mapping, in CISA's numbering, is at getcaver.com/cisa-logging. The most useful version of the conversation is section by section against your estate, including the parts where the answer is that you have work to do.
It is a reading of a public document against a product, done by the product's vendor. It is not an endorsement, a certification or a relationship with CISA, and nothing here should be read as one.
For the moment an incident becomes a legal, regulatory or contractual matter.
At that point someone outside your security team needs to trust the record without trusting your vendor. The Evidence Locker is built for that:
What this means for you: the difference between "we have logs" and "we have a record an investigator, an opposing expert or an insurer can independently verify."
The AES-256 password protects the contents of the archive. The list of file names and their sizes is still readable without the password, which is how the ZIP format works. If a file name would itself reveal something, rename it before export.
AI assistants are already inside most organizations, usually before anyone counted them.
Microsoft Agent 365 registers every AI agent and sets what it is allowed to touch, at sign-in. It answers who an agent is. CAVER reads that same event data and watches behavior over time, and also covers the tools Microsoft never sees: Claude, Cursor, Codex, Copilot, OpenAI and others.
What is included: 24 content packs and over 200 rules, covering prompt manipulation, data leaving through an AI tool, misuse of connected tools, and runaway automation.
CAVER can also sit in front of your AI traffic as a checkpoint, with a full audit trail, per-user limits and blocking of unapproved AI services. Someone pasting confidential material into an unapproved AI tool becomes a recorded, scored event rather than something nobody sees.
We have no published CAVER-specific measurement for the delay this adds. It is one extra step in the request path, which is small next to the one-to-six seconds an AI request already takes. Ask us for a firm number before relying on it for a decision.
CAVER's own MCP server gives agents capability-scoped, audited, signed read access, and every assistant call is costed per user and per case. AI triage verdicts on notables carry a confidence and a rationale, and a person confirms them.
One product, not a different tool for every environment.
CAVER runs on Kubernetes, a virtual machine, an isolated network, or a single box. License activation does not need an internet connection, and a lapsed license gives you a 14-day grace period rather than shutting off mid-incident.
This is your risk decision. Both are real products. Neither is a discouraged version of the other.
SAML 2.0 and OpenID Connect are both configured in the product: paste or fetch your identity provider's SAML metadata, or point at your OIDC issuer for discovery, then map the attributes or claims to roles. Test against the live provider before you can turn it on: enable is refused without a successful test in the last 24 hours. A saved change or a disable takes effect on the next request, no restart, and local login stays reachable so an identity-provider outage cannot lock your operators out. An OIDC client secret is sealed in the product's credential vault, never stored in the clear.
SCIM provisioning is configured the same way: an operator mints a bearer token for the identity provider, shown once and stored only as a hash, revoked on the very next request rather than the next restart. Group membership from SAML, OIDC, or SCIM maps to roles by the same rule.
Deploy with Docker Compose, Helm, or Terraform for AWS and Azure. Collectors install as .deb, .rpm or a Windows or macOS service. A fleet server pushes configuration with canary promotion and kill switches, and caver-doctor checks health and heals common faults. One command migrates Splunk apps, dashboards, ITSI and UBA content, Elastic and Kibana, Sentinel rules, workbooks and playbooks, and Defender and QRadar content, with a dry run first.
Available to design partners: Carbide Console, the endpoint management plane, with signed versioned policies and rollout rings, allow and deny execution control by hash, signer or path, disk-encryption posture and recovery-key escrow, and enrollment through Intune, Jamf or Group Policy. Also available to design partners: a clustered CAVER with a stateless query tier that scales search horizontally over the shared lake, and Carbide for containers, with a Kubernetes DaemonSet and Helm install.
Available on request, typically delivered within 30 days of order: a collection reason on every log, so you can see which policy caused it to be kept and which volume serves no policy, and saved searches and reports emailed on a schedule.
Two different questions. Systems that send us logs, where the vendor matters because you have to switch the feed on. And equipment watched on the network, where it mostly does not.
| Category | How it reaches CAVER | Status |
|---|---|---|
| Cloud platforms | Native audit trails from AWS, Azure, Google Workspace, Microsoft 365, Cloudflare | Ready-made packs |
| Endpoints and network | EDR, Sysmon, firewalls, VPN, DNS, proxies | Ready-made packs |
| Carbide, our own endpoint agent | Kernel-level process telemetry on Linux, Windows and macOS, shipped to CAVER directly | Included; AIX for design partners |
| Exploitation feeds | CISA KEV and FIRST EPSS, joined onto findings | Ingested daily |
| Identity | Entra ID, Okta, Active Directory, Duo | Ready-made packs |
| Industrial equipment | More than a dozen industrial protocols decoded passively from mirrored traffic | Included, no extra product |
| AI tools | Microsoft Agent 365 event data, plus Claude, Copilot, OpenAI and others | 24 packs, 200+ rules |
More than 400 ready-made vendor packs ship for the common systems, so the bespoke work is the exception rather than the starting point.
Existing agents work unchanged: Splunk HEC and Universal Forwarders, Elastic Beats and Logstash, OpenTelemetry for logs, metrics and traces, Prometheus remote-write, syslog, Kafka, Kinesis, S3, NetFlow, sFlow, SNMP and Windows Event Forwarding with no collector box.
Fifteen open threat feeds ship enabled, including abuse.ch, OTX, CISA KEV, AIS and CSAF, MISP, Spamhaus and GreyNoise Community. STIX and TAXII custom feeds and an IOC bloom filter match at detection time. Commercial feeds such as Recorded Future, Mandiant, CrowdStrike Intel, VirusTotal, Anomali and DomainTools connect with your own subscription, delivered on request.
A trial is 60 days, $25K to $75K, credited fully toward your first year if you proceed. If you are replacing Splunk, a displacement credit of 25% to 50% off year one is available separately.
Do not take this paper on faith. Test it directly: