Early adopter — GA 26h4
No logs shipped to a vendor. A flat monthly fee with no per-GB or per-event pricing. A built-in flow-log cost guardrail. And deterministic scoring — rules and math decide every finding; AI only explains, and its output is validated.
Subscribe on AWS Marketplace Contact us — Enterprise+ / private offerDeploys on your existing Log Processor VPC and OpenSearch — a single CloudFormation stack, typically under an hour.
No customer data goes to any non-AWS endpoint. AI prose is generated by Amazon Bedrock in your own account (it doesn't retain or train on it). The only calls that leave AWS are the Marketplace entitlement check and optional threat-intel lookups you can disable.
A flat monthly software fee per tier with zero per-metric charges — you pay AWS at cost. No per-GB ingestion pricing that punishes volume, and infrastructure reuses your existing Log Processor stack.
VPC Flow Logs are the runaway-cost risk in any SIEM. AI SIEM keeps them in S3 and runs scheduled Athena sweeps, so cost scales with query cadence — not traffic volume or account count. A traffic spike can't trigger a surprise bill.
The AI explains; it never decides. Every threat score, count, and severity is computed by rules and math — not a language model. Bedrock writes only the prose in playbooks and summaries, with numbers templated in and invented identifiers rejected.
Early-access design partner program: the full Perfware platform (Log Processor + AI Monitor + AI SIEM) at discounted suite pricing, in exchange for feedback and — a willing reference. Limited cohort, through AI SIEM GA. Contact us →
AWS security services are powerful but fragmented. Without correlation, teams can't see the full picture:
AI SIEM unifies your AWS security signals into one platform — running in your account, at a flat fee:
Design-partner references coming soon. Want to be one? Join the early-access program →
The capabilities security leaders buy AI SIEM for. The documentation hub carries the full feature set.
CloudTrail, VPC Flow Logs, GuardDuty, Config, and Security Hub merged into one chronological incident view per threat actor — with detections mapped deterministically across 13 of the 14 cloud ATT&CK tactics, so the timeline shows the kill chain advancing tactic by tactic. See the coverage breakdown.
Learns what "normal" looks like per IAM principal across nine behavioral dimensions — APIs, times, IPs, regions, resources, and the identity's own type. Alerts on deviations without manual threshold tuning.
Automatically connects related events: compromised credential + unusual S3 access + port scanning + GuardDuty alert = one correlated threat, not four disconnected alerts.
Rules and math decide every score, count, and severity — not a language model. Bedrock, running in your own account, writes only the prose in playbooks and summaries, with numbers templated in and invented identifiers rejected. The AI explains; it never decides.
VPC Flow Logs are the runaway-cost risk in any SIEM. AI SIEM keeps them in S3 and runs scheduled Athena sweeps for the patterns that matter — port scanning and large egress — so cost scales with query cadence, not traffic volume or account count. A spike can't trigger a surprise bill.
Enterprise tier. Map any threat type to an AWS Systems Manager Automation runbook — AWS-managed prebuilts or your own — and AI SIEM runs it under a role you own. It starts the automation and never holds standing write access to your accounts. Stage for approval, schedule to a window, auto-resolve on success; every action lands in the tamper-evident WORM audit trail.
Deploy once and monitor many accounts (advanced+). AI SIEM reads CloudTrail and VPC Flow Logs from remote accounts over cross-account IAM roles, and ingests GuardDuty, Security Hub, and Config findings forwarded to its event bus — authorize accounts individually or a whole AWS Organization. Every event keeps its originating account, so threats and timelines stay attributed. Up to 200 sources on advanced, unlimited on enterprise.
Custom detection rules, context-aware severity, scheduled threat reports, compliance posture, configuration-integrity monitoring, analyst queues, threat intelligence, per-VPC tuning, and more — Full documentation →
AI SIEM reads CloudTrail and VPC Flow Logs over cross-account roles and ingests forwarded GuardDuty, Security Hub, and Config findings — scoped per account or across a whole AWS Organization. Because Log Processor and AI Monitor already span those accounts and share the same OpenSearch domain, AI SIEM inherits their application and metric coverage with nothing extra to wire.
AI SIEM requires Log Processor (the shared VPC and OpenSearch domain it deploys onto — no new cluster) and optionally integrates with AI Monitor (advanced+) for metric-driven detection. Each works standalone; together they cover the full kill chain while reusing one VPC and OpenSearch domain instead of a separate stack per tool.
When AI Monitor flags an anomalous network-egress spike, AI SIEM runs a scoped Athena query against the already-captured flow data for just that resource and window — destination IPs, ports, and byte volumes for the minutes that matter. Full forensic detail at query cost, without paying to stream and score every flow record.
AI Monitor metric anomalies and Log Processor application-log patterns correlate into the same threat timeline as the CloudTrail and GuardDuty events on the same resource and window — so infrastructure and application signals land beside the security events, not in three separate tools.
Deploy a single CloudFormation stack, then start detecting threats.
Single CloudFormation stack deploys on your existing Log Processor VPC and OpenSearch domain. No new infrastructure to manage.
Point to your CloudTrail bucket, enable VPC Flow Logs, and GuardDuty + Security Hub events flow automatically via EventBridge. If AI Monitor is deployed on the shared domain, its metric anomalies (and Log Processor patterns) correlate in with no extra wiring.
ML models learn normal behavior per principal within 7–14 days. Static rules catch known-bad patterns immediately.
Threats surface with full timeline context, MITRE mapping, and AI-generated playbooks. Enterprise tier can auto-remediate.
Software fee only. AWS infrastructure costs are billed directly by AWS to your account.
Yes. AI SIEM deploys on the VPC and OpenSearch domain created by Log Processor. This avoids duplicating infrastructure and enables cross-domain correlation between logs, metrics, and security events.
No customer data goes to any non-AWS endpoint. All processing runs inside your account, and playbook/report prose is generated by Amazon Bedrock in your own account and region — the threat context sent to Bedrock stays within AWS, and Bedrock does not retain it or train on it. The only calls that leave AWS are an entitlement check to verify your Marketplace subscription (no customer data transmitted) and, if you enable it, optional threat-intelligence feed lookups you can turn off.
A flat monthly software fee per tier (see Pricing above), with no per-GB or per-event charges. AWS infrastructure is billed directly by AWS to your account — typically $20–$80/mo for Lambda, S3, DynamoDB, and Bedrock. OpenSearch is shared with Log Processor (no additional cluster cost). CloudTrail and VPC Flow Logs carry their own AWS charges regardless of AI SIEM.
AI SIEM correlates all of those into a single timeline with behavioral ML that learns YOUR account's normal patterns. GuardDuty detects; AI SIEM correlates, explains, and responds. Security Hub aggregates; AI SIEM connects the dots into attack narratives.
Flow logs are the highest-volume source a SIEM handles, so AI SIEM defaults to an Athena mode that keeps their cost flat and predictable. Instead of running every flow record through the pipeline, flow logs stay in S3 and scheduled queries scan them for the patterns that matter — port scanning and large data egress. Cost scales with how often those queries run, not with your traffic volume or account count, and the built-in VPC Flow panel shows the estimated scan cost so there are no surprises. Every flow log is still retained in S3 and fully queryable for forensics.
More questions — suite integration, deployment, upgrades, data handling, and the full operational detail? See the documentation →
The full reference — features, configuration, and the complete FAQ — lives on the documentation hub. Deployment and guide downloads below.
Pre-sales enquiries. Questions about AI SIEM, licensing, or professional services? Contact us →
Already a customer? Product support is available from the Support button on your deployed application's landing page (alongside the Subscription Editor and OpenSearch Dashboards, per your plan's SLA), or email support@perfware.cloud.