01
Object storage is the system of record
Accepted events are archived to object storage, the system of record. The search tier is built from that archive, so evidence does not depend on the search tier.
Discover
From a broad hunt to the exact field. In one place.
Start wide across normalised events, narrow to the parsed log and finish on the field that decides the question — without exporting to another tool. Ask in plain language or write a structured query.
365 days of event retention by default
ask› every login for a.rao across the last 90 days90 days · 4 sources
| TIME | USER | SOURCE IP | DESTINATION | SIGNAL |
|---|---|---|---|---|
| 21:14:03 | a.rao | 185.220.101.47 | vpn-gw-02 | TOR |
| 21:13:47 | svc-backup | 45.84.107.54 | m365 | SPRAY |
| 21:12:58 | a.rao | 102.129.145.8 | entra-id | NEW GEO |
| 21:11:21 | a.rao | 10.14.22.8 | adfs-01 | OK |
AI ANALYST · ADVISORY · EVIDENCE LINKED217 failures then one success from a first-seen Tor exit, followed by finance-share enumeration. Recommend: disable account (Sensitive · needs approval).ev.1ev.2ev.3
How it works
From a question to the field that answers it.
- Plain-language and structured queries run against the same normalised data.
- Every result keeps its parsed record and raw field detail one click away.
- Pivots are preserved, so the path to the evidence is part of the evidence.
- Retention defaults: 30 days hot, 90 days warm, 365 days in total — configurable per tenant.
02
Fields that do not map are kept
Sources normalise to kymeer's canonical schema. Fields the schema does not know are retained alongside, so nothing your source said is thrown away.
Specifications
| Query modes | Plain language · structured query |
|---|---|
| Schema | Canonical schema; unmapped fields retained |
| Default retention | Events: 30 d hot / 90 d warm / 365 d total · incidents up to 7 years |
| Storage | Object storage as system of record; search tier built from it |
| Performance | Measured during your evaluation, on your data |