RunReveal FAQ

RunReveal is the modern security data platform reimagining traditional SIEM by combining data collection, threat detection, investigation, and AI-powered analysis in one unified platform.

RunReveal is specifically designed for security engineers, heads of security/security leadership, and SOC analysts who need to detect, investigate, and respond to threats efficiently.

Unlike legacy SIEMs, RunReveal was built from the ground up for modern cloud environments. It offers faster unified tooling (no more need to buy Splunk + Cribl + an AI SOC....) search performance, transparent pricing, fewer false positives through correlated alerting, and native AI integration for investigations.

RunReveal's platform provides log collection and enrichment and normalization, high-speed search, automated threat detection with correlated alerting, detections-as-code, AI-powered chat for investigations, data visualization and dashboards.

Yes, RunReveal supports detections-as-code written in SQL. RunReveal also offers migration support to move existing detections to RunReveal.

RunReveal uses a transparent, predictable pricing model based on two main factors: data volume ingestion and deployment option. This approach eliminates the complex licensing fees, per-user costs, and hidden charges common in traditional SIEM solutions. To see more about our pricing, please visit our Pricing page.

RunReveal offers a truly unified platform that combines data collection and management, detection, investigation, AI chat, and visualization in one seamless experience, while Panther focuses primarily on detection-as-code with Python rules and requires additonal tools for comprehensive security operations. RunReveal's modern infrastructure delivers blazing-fast search performance and native AI integration that cuts investigation time from hours to seconds, compared to Panther's AWS Lambda-based architecture that still requires manual coding for most detection scenarios.

RunReveal gives you everything you need in one simple platform—AI-powered investigations, lightning-fast search, and modern infrastructure that just works out of the box. Splunk requires you to piece together multiple tools and manually normalize the data before you get any value from it at all. In addition, RunReveal's straightforward pricing model and built-in data filtering enables our customers to have enterprise-grade SIEM without enterprise-grade SIEM costs.

RunReveal delivers a unified platform combining data collection, detection, AI-powered investigation, and visualization in one seamless experience, while Elastic requires assembling multiple siloed components (Elasticsearch, Logstash, Kibana, Beats) and manual dashboard configuration, and ongoing laborious index maintenance to keep search times reasonable. RunReveal's modern ClickHouse infrastructure provides ridiculously fast performance with native AI chat that cuts investigation time from hours to minutes (or even seconds!), compared to Elastic's complex multi-component architecture that demands significant expertise to operate effectively.

RunReveal uses a transparent, predictable pricing model based on two main factors: data volume ingestion and deployment option. This approach eliminates the complex licensing fees, per-user costs, and hidden charges common in traditional SIEM solutions. To see more about our pricing, please visit our Pricing page.

Yes, RunReveal offers a minimum 2-week free trial for teams wanting to try out the product. Please reach out to our team here to learn more about the trial and getting started.

With RunReveal's free tier provides 20GB of monthly log ingestion, full platform access, 5 source integrations, and 30-day data retention. Simply sign up and begin connecting your data sources to get started.

RunReveal's transparent, usage-based pricing eliminates the complex licensing, per-user fees, and hidden costs common in traditional SIEM solutions, making it significantly more cost-effective solution for most organizations.

RunReveal is very flexible in terms of how and where we can deploy. From the fully managed SaaS offering that you can instantly onboard without having to talk to our (admittedly lovely) sales team, to self-hosted on-premises bare metal deployment, we can do that!

All data is encrypted at rest and in transit. Sensitive authentication tokens are additionally encrypted at the application layer. All RunReveal employees must use yubikeys and two factor authentication for accessing services. We log every access to databases and make those audit logs available to customers. See our security center for more details.

RunReveal can deployed in minutes for RunReveal Cloud or under a day for other deployment modes! We pride ourselves on making the deployment and integration process simple, so your team can start driving immediate value and insight from the platform.

RunReveal offers compliance and certification that all security teams can love. RunReveal is SOC 2 Type 2 certified, GDPR and CCPA compliant, and offers many enterprise-grade security features (e.g., SSO, RBAC, multiple deployment options). To learn more about RunReveal's security certifications and processes, please check out our Security page.

Yes, RunReveal offers both Single Sign On (SSO) and Role-Based Access Control (RBAC).

Please see the list of current integration support here.

The team is adding new integrations and sources *daily*; simply reach out to our team here, or fill out the Integration Request form on this page, and our team will be in touch with you.

RunReveal's AI capabilities include native AI chat and a Remote MCP Server to enable natural language investigation and automated detection creation.

RunReveal supports a Remote Model Context Protocol (MCP) Server to enable AI-powered investigations and detection management, enabling you to resolve incidents with speed and detail using context-aware AI chat.

Yes, RunReveal's AI Chat feature allows you to integrate your own LLM API keys, supporting various AI model providers including Claude, ChatGPT, and other compatible systems through the MCP protocol.

RunReveal's integrated AI agent cuts log analysis time from hours to seconds by automatically surfacing critical insights and accelerating investigation workflows, helping security teams focus on real threats instead of getting overwhelmed by noise. The RunReveal AI chat also supports managing detections directly through natural language chat.

Yes, RunReveal can help with data migration from existing SIEM solutions. The platform's flexible ingestion capabilities and account team can assist with transition planning and execution.

RunReveal offers comprehensive documentation, hands-on support during setup, and guidance on best practices for detection engineering and security operations from our seasonsed internal security practitioners.