Skip to content
Logmetry
What we solve
SIEM and log costClean data for AI agentsCoverage, audit and PIIVendor independenceSIEM migrationObservability modernizationAll problems we solve
Who it’s for
For the CISOFor the CIO and CTOFor the CFOFor Architects
Platforms
SplunkMicrosoft SentinelCrowdStrikeElasticDatadogDynatraceSplunk ObservabilitySolarWindsCriblOpenTelemetryA Data LakeCompare the options
The Blueprint
The whole methodPhase 01 · FoundationPhase 02 · AI triagePhase 03 · RemediationPhase 04 · FootprintEverything as codeAI native
JournalAbout
About LogmetryYour teamTrust and securityStep one and the proofWhere we fit
Book the review

Step one and the proof

See it on your noisiest source, in two weeks. Free until you decide to go ahead.

A two-week proof of value on your noisiest source, with success criteria signed before it starts, measured in your SIEM’s own license usage view. The review and the two-week proof cost you nothing. If you decide not to go ahead, for any reason, even after a pass, you owe nothing. If you go ahead, the project is a fixed fee, agreed in writing before it starts.

Book the architecture reviewWhat gets measured ↓

01Step one

What we sell now.

A pipeline in front of your SIEM, designed and built by Logmetry. Your SIEM stays. A full raw copy stays in your own account.

  • Your SIEMWhat your rules read, at least 20% less. Every alert kept.
  • Your lakeA clean, enriched copy, ready for AI when you want it.
  • Your archiveThe full raw copy, stored cheaply, kept to your policy. Any hour replays into the SIEM on request.
  • Later, when you want itAI triage on the clean copy: read-only, on a model you approve, in your own account, with a person reviewing every exception. Sold only after step one is proved on your data.
  • Later stillOpen collection you own, then monitoring you own. They are part of the Blueprint, and never part of step one.

02The proof

Criteria signed first, read in your license view.

Criteria your team signs before day one, nothing changed in your SIEM, and nothing to pay.

  1. Step 1Free

    Free architecture review

    Your SIEM feed drawn from your diagrams, and a sized estimate. No system access.

  2. Step 2Guaranteed

    Two-week proof of value

    Your noisiest source, criteria signed first, measured in your own license usage view.

  3. Step 3

    Source by source

    Typically one to two weeks each, with acceptance criteria agreed in writing before each starts.

At least 20% less into your SIEM, every alert kept, proved on your data.

CriterionHow it is measuredPass
1Volume into your SIEM for this source fallsYour license usage report, split by source type, before and afterAt least 20%
2The named detections still fire on the reduced streamReplay of the detections you name for that sourceAll pass
3A full raw copy in your storage, searchable, kept to policySampled hours retrieved from your archiveAll retrieved
4The same AI investigation, run on the clean Lake, uses fewer tokens and gets as far or furtherSample alerts investigated by the same model on the raw events and on the cleaned, enriched copy, in your accountFewer tokens, findings as good or better
Dates
A fixed start and end, two weeks.
How it runs
A copy of the live stream through the pipeline. The path into your SIEM is not changed.
Who validates
Your SIEM admin and a SOC analyst.
Cost
Nothing. Not for the proof, and not for walking away after it, even after a pass.
If you go ahead
The project is a fixed fee, quoted for your estate and agreed in writing before it starts.
Exit
A clean teardown. Your SIEM unchanged, and you keep the configuration.
Readout
On day 14, the before and after for every criterion, in your own numbers. What you do next is your call.

03After the proof

Your numbers, ready to present. The call is yours.

We prepare everything, so your team does not have to. Your SIEM admin and a SOC analyst validate the results, and you take them to your leadership with the material already made.

  • The metricsVolume per source before and after, read from your own license usage view, every number traceable to it.
  • The detectionsEvery detection you named, replayed on the reduced stream, pass or fail.
  • The presentationThe before and after, as a presentation ready for your SIEM admin and your leadership.
  • The configurationThe pipeline as it ran in the proof, yours to keep whatever you decide.

If you go ahead, we plan the rollout around your team at a fixed fee. If not, you owe nothing and keep it all.

04Questions

What teams ask before they sign the criteria.

What does the proof cost?

The review and the two-week proof cost you nothing. If you decide not to go ahead, for any reason, even after a pass, you owe nothing. If you go ahead, the project is a fixed fee, agreed in writing before it starts. We would rather earn the project on your own numbers.

What if it passes and we still decide not to go ahead?

You owe nothing, and you keep the readout and the configuration. A pass is a reason to go ahead, never an obligation to.

What if the floor is missed?

You owe nothing. You keep the configuration and the readout, and your SIEM is unchanged.

Does anything change in our SIEM during the proof?

No. The proof runs on a copy of the live stream, and the path into your SIEM is not changed. The way back is one output setting on each forwarder, then a restart.

Is there a demo we can see first?

Not a published one yet. The free review draws your own SIEM feed and sizes the saving on your volumes, and the proof then shows it live on your data. We would rather show you your numbers than ours.

What happens after a pass?

That is your call. If you go ahead, the project is a fixed fee agreed in writing, then source by source, typically one to two weeks each, with acceptance criteria agreed before each starts. If you want more time, or more numbers for your leadership, we work with you on that.

See your architecture drawn, with the costs, before you spend anything.

Our lead architects draw your SIEM feed from your diagrams: where the cost sits, what step one would change, and where it would not pay. If it pays, the next step is a two-week proof on your noisiest source.

Book the architecture reviewOr take the Blueprint as a PDF →

Free. No system access. No obligation. You keep the drawing.

What you get

  • Your architecture today, drawn
  • The waste map
  • Costs before and after, with estimates
  • Your target architecture
  • Options for your business problem

What it costsNothing