Threat hunting
Goes broad, shortlists hypotheses, and sends a sub-agent after each one. Run it in front of you or overnight on a schedule, across all your data.
An AI analyst that lives inside your SIEM.
Not a chatbot bolted onto a dashboard. The AI works inside LogMan.io with the same tools and permissions as your analysts: it hunts, investigates, opens the ticket, contains the threat through your playbook and writes the report. Your logs stay on your side; the models run inside your perimeter or in our sovereign AI cloud in the European Union.
Request a demo Compare the editions
Available as an extension to LogMan.io PLUS and LogMan.io SIEM.
From a hunch to a contained threat.
Type "run a threat hunt" — no target, no details, just a hunch. This is what the AI does next.
-
It forms a hypothesis
The AI loads its threat-hunting playbook, decides what to look for — a machine quietly calling somewhere it shouldn't — and checks the idea against your data before going deeper.
-
It delegates the deep dive
A sub-agent takes the lead. It pairs network metadata from Zeek with process events from Sysmon and traces the suspicious traffic to the process and host behind it.
-
It opens a ticket worth reading
Evidence, data sources, confidence level, MITRE ATT&CK techniques and recommended next steps — in alert management, ready for triage. No more empty tickets.
-
It contains — and checks
Tell it to "block it on the firewall" and it follows your incident-response playbook, adds the rule, then schedules itself to verify 20 minutes later that the traffic has really stopped — without being asked.
The work of a SOC analyst, from hunt to report
Out of the box, the AI comes with skills for the daily work of security operations — and you can teach it your own.
Investigation and triage
Pulls in network, endpoint, DNS and asset context, classifies how confident it is, and writes a ticket your analyst can act on straight away.
Incident response
Follows the playbooks you write, on the systems you allow — block on the firewall, gather forensic evidence, isolate a host — and logs every step in the ticket.
Detection engineering
Finds a gap in your MITRE ATT&CK coverage, writes the detection rule, builds unit tests for it, and deploys it.
Parser building
Give it sample logs and it builds a parser to the ECS schema, compiling and testing it in a sandbox until every sample passes.
Reports
Turns an investigation into a report for management: affected machines, observed behaviour, blast radius, recommended next steps. In your language, with your terminology.
Built in, not bolted on
LogMan.io was built on open formats — Markdown, YAML, JSON — long before AI arrived. That turned out to be exactly what AI agents work best with, and it is why the AI could be integrated this deeply.
A harness inside your LogMan.io
The AI harness runs in your LogMan.io cluster and talks to the platform through the same API your analysts use. Tools are discovered from the platform automatically, with no extra connector to expose and no inbound connection to open. You can close your laptop; the work carries on.
A sandbox for every agent
Each agent works in its own isolated sandbox, with the tools analysts use and a query engine. It pulls the data it needs, analyses it there, and keeps every query and file — so you can rerun any finding and see that it holds.
Skills you can read and edit
Every playbook and prompt is a Markdown document in the LogMan.io Library, distributed like parsers and editable like them. Add a brief about your infrastructure, write your own procedures — or walk the AI through a task once and tell it to turn that into a skill.
A memory that stays with you
As it works, the AI learns your environment: network ranges, how to reach the database, what you changed six months ago. That memory is readable, editable, and stays in your harness — when an analyst leaves, their know-how doesn't.
Your logs stay where they are.
Most AI SIEMs assume you'll ship your data to their cloud, to be analysed by a proprietary US model. LogMan.io doesn't. It runs on leading open-weight models, which we evaluate continuously and replace as better ones appear — so you're never locked into one model or one vendor.
The heavy lifting stays local
The analysis happens in the sandbox next to your SIEM. Raw event streams are never sent to the model; it works with queries and condensed results.
Run it on-premises
Put the models on a GPU server inside your own perimeter, air-gapped if you need it. Already run your own AI infrastructure? Connect it instead.
Or use our sovereign AI cloud
No GPUs of your own? Use our AI cluster in a Tier III data centre in the European Union, under European law.
Never used for training
We commit contractually, under terms drawn up for the EU AI Act, never to use what you send us to train models. Your skills and memory are your property, like your parsers and rules.
As much autonomy as you're ready to give it
These agents are diligent and relentless — they will use every access they're given. That is why the boundaries are hard ones, set by you, not just instructions in a prompt.
Human in the loop or fully autonomous
Watch the AI work and step in at any point, or let tasks run in the background on their own. Mix the two per task.
The same permissions as a user
The AI is governed by LogMan.io roles and tenants like any analyst. It can only reach the systems you give it credentials for.
Approval for sensitive actions
A policy decides which commands need a human sign-off — an SSH session, a deletion — before the AI may run them.
Nothing hidden
Its reasoning, every command and every model call are visible and logged, and you can open a terminal into its sandbox to see what it sees.
Start small.Widen as trust grows.
Our engineers supervise your first deployment and train your team — so the AI's reach grows only as fast as your confidence in it.
-
Inside LogMan.io only
Analysis, alert triage, parsers and detection rules — the AI works within the platform and touches nothing else.
-
Teach it your environment
Let it map your infrastructure, and turn your SOC's procedures into skills it follows.
-
Let it act
Grant access where a response is well defined — a firewall, test servers — with approval on anything sensitive.
-
Let it run
Scheduled hunts overnight, autonomous triage, reports in the morning. Your analysts review what matters.
Frequently asked questions
Which editions can run the AI?
The AI is an extension to LogMan.io PLUS and LogMan.io SIEM — the editions with security detection for it to work with. If you run LogMan.io today, the step up is a licence change, not a migration.
Is this an AI SOC?
It is an AI SIEM: the platform you build your AI SOC on. The skills to work semi-autonomously are there out of the box; every SOC then adds its own procedures, roles and playbooks as skills.
Does my data leave my environment?
Your logs and the analysis of them stay on your side, in the harness next to your SIEM. If you run the models on-premises, nothing leaves your perimeter at all. If you use our sovereign AI cloud, only the model's working context travels — within the European Union, under European law — and it is never used for training.
Which models does it use?
Leading open-weight models, run on our own hardware or yours. We test new models as they are released and swap them in when they do the job better, so the analytical quality keeps rising. You can also connect your own model endpoints.
Can the AI do something I didn't allow?
It can only reach what you give it access to: LogMan.io permissions, the credentials you provide, and an isolated sandbox. Sensitive commands can require human approval. Prompts set the behaviour; the access you grant sets the hard limit.
Does it work in Czech or Polish?
Yes. The interface is in English, Czech and Polish, and you can talk to the AI and get reports in your language. A glossary of your preferred terms keeps the wording right. For the most demanding analysis, English still gets the best out of the models.
Can I use skills from GitHub or my own MCP servers?
Yes. LogMan.io uses the standard skill format, and it ships a skill that vets a third-party skill and adapts it to your environment — treat downloaded instructions with the same care as downloaded code. MCP servers can be connected as an additional source of tools.
How is it priced?
A monthly subscription per seat — the number of AI agents you run, sized to your organisation. No tokens, no credits, no per-action fees. Ask us for a quote.
See what the AI finds in your own data.
Show us your environment and sources. Our engineers will run the AI on real traffic — and tell you which edition and how many seats you need.
Book a demo
Tell us about your log volumes and sources, and one of the engineers who built LogMan.io will get back to you — usually within one working day.
Thank you — message received.
One of our engineers will be in touch shortly. If it's urgent, call us on +420 604 806 483.