logrok

What logrok is

logrok is a self-hosted log management and threat detection platform that runs inside a customer’s environment. It ingests logs from syslog, webhooks, cloud APIs, and files; the maker states that one node handles 200K+ events per second. Search accepts plain text, regular expressions, Lucene syntax, and natural-language AI queries. Detection includes more than 25 built-in rules mapped to MITRE ATT&CK, correlation logic, and a custom rule DSL. Logrok lists over 20 destinations, including S3, Kafka, Splunk, Elasticsearch, Azure, GCP, Loki, and Datadog. AI features include noise filtering, anomaly detection, an investigation assistant, natural-language search, and an MCP server. It describes offline and air-gapped operation without telemetry or call-home. Security controls include AES-256-GCM encryption at rest, multiple authentication methods, append-only audit logs, and role-based access control. The Community tier is a free single-host Docker Compose trial kit; pricing is on request.