Hunt & search

In kymeer you search your events in plain language or with a structured query, and every search stays inside your own tenant. By default, events are kept for 365 days.

How do I search?

There are two ways in:

• Plain language. Type a question, for example "failed logins for one user in the last 7 days". kymeer turns it into a structured query. If no AI model is available, a built-in rule-based planner still handles common questions about time windows, users, IP addresses, ports, hostnames and outcomes.
• Structured query. A typed query of fields, operators and aggregations. There is no raw SQL: kymeer builds the database query itself and escapes every value.

Both run against the same normalised event data.

What can I search?

Search	What it covers
Parsed events	Events that were normalised, filtered by field
Unparsed events	Events that did not parse, by keyword
Raw events	The raw records as received

Unparsed events are searchable rather than discarded, so a source kymeer cannot yet read still leaves evidence. See Formats and the Parser Factory.

Who can see my results?

Your tenant is taken from your signed-in session, never from the request. Every search, whether allowed or denied, writes an audit record, so searching is part of the evidence trail.

When you export results, the raw log line is left out by default.

How long is data kept?

Data	Hot	Warm	Total
Events	30 days	90 days	365 days
Indicators	30 days	90 days	730 days
Incidents	90 days	365 days	2,555 days (about seven years)

Retention can be set per tenant. An optional retention lock sets a minimum period before events can be deleted; it can only lengthen retention, never shorten it.

Where is the evidence stored?

Accepted events are archived to object storage, which kymeer treats as the system of record. The search tier is built from that archive.

Related

• Detection and ATT&CK
• AI analyst