Scanner

Query the Scanner API to search through logs in object storage at high speed.

Introduction

Scanner is a SIEM that is designed from the ground up for cloud scale. It analyzes your logs in S3 cloud storage in-place, and using a novel indexing system, it provides your team with lightning fast search for threat hunting and detections. Ingest terabytes of logs per day at low cost.

Since Scanner is designed for cloud storage and serverless compute, log ingestion is 80-90% less expensive than other tools. You are no longer forced to choose which log sources to drop and which to keep. You can cover them all.

For more information on Scanner, see Scanner.dev.

Getting Started

To configure the plugin to send queries to Scanner, provide the API URL of your Scanner instance and an API key in the config editor.

To locate your API URL, navigate to Settings > API Keys in Scanner.

You can use an existing API key or create a new API key.

Documentation

• Using Scanner