Forwarded
Only the events worth indexing reach the SIEM. This is the only path you are billed for.
SAFI · SECURITY DATA PIPELINE
Your SIEM is billing you
for logs nobody reads.
SAFI classifies every event at the edge with rules you can read. Only what is worth indexing goes to the SIEM. Everything else is kept in full where storage is cheap.
86.4%less volume sent to the SIEMVerified · SAFI, measured across 7,959,818 events on a production estate
7,959,818events in that measurementVerified · one production estate, not a guarantee for every estate
THREE ENDINGS, ONE ARCHIVE
Data is not deleted.
It stops being metered.
Archived
Kept in full, searchable, at storage prices rather than indexer prices.
Dropped, with a reason
An event must be named twice, once as low value and once as noise, before it can be dropped.
Raw, always
Every event reaches the raw archive whatever the verdict. That keeps the rest auditable and makes replay possible.
EVERY RULE HAS A PROCESS
Rules you can read,
test and reverse.
- 01
Write it
A plain-text rule file on the collector: what it matches and the class it assigns.
- 02
Give it a case
One log that hits it, and the near miss that must not.
- 03
Prove it
The whole catalogue runs, and each case must reach the rule it claims.
- 04
Ask the engine
The real pipeline is validated by Vector itself.
- 05
Replay last week
See every verdict that moved, and the volume it adds or removes, before anyone is affected.
- 06
Push from the console
A versioned config pack. Nobody opens an SSH session to change a rule.
- 07
Reverse it
The previous pack is still there, and every change is in the audit trail.
AI INSIDE SAFI
Rules catch what you know.
AI catches what you don’t.
Alongside the readable rules, AI learns what normal looks like in your security events and flags what breaks the pattern. It is available with SAFI release 14 as an add-on: OpenSearch machine learning on the data SAFI has already made uniform.
Learns normal
The model learns the usual rhythm of each source, host and account: volumes, event mix and time of day.
Flags the unusual
Spikes, silences, rare event types and activity at odd hours are scored on the streams SAFI keeps.
Shows why
Each anomaly comes with the baseline it broke and the events behind it, so an analyst can judge it quickly.
Never deletes on its own
Anomalies go to the SIEM for a person to review. The AI never drops an event, and every event still reaches the raw archive.
TRY IT IN YOUR BROWSER
Nothing on the demo
is a mock-up.
The live demo runs a real deployment's rule set in your browser, anonymised. Pick a log line, or paste one of your own, and watch each stage of the chain decide.
Stack: Vector · OpenSearch · Wazuh. Replay is an add-on, switched on only for customers who ask for it.
STAY CURIOUS
Measure it on your own data.
A proof of concept is time-bounded and milestone-gated. Please do not send raw logs or credentials with your first message.