Search every log, from this morning or from last year, in one place
Log Explorer is where analysts search every stored event, from today's firewall logs to last year's sign-ins. Use filters or write SQL, and save the searches you run often.
Filters or SQL
Click to add filters, or switch to SQL, the standard database query language, with autocompletion for fields and keywords.
Cold data included
Search older data in the cold tier the same way as recent data, with no snapshot restore.
Related events
Open a log and pull up the events around it to see what happened just before and after.
Saved searches and tabs
Save the queries you run often and keep several investigations open in tabs.
Table or chart
Switch results between a table and a chart, choose the columns you need and resize them.
Raw and parsed side by side
Every result keeps the original log line, and you can copy any event as JSON.
Questions buyers ask
Can I search data that has moved to cold storage?
Yes. UTMStack keeps cold data searchable without restoring a snapshot first. You decide how long data stays in each tier, up to 5 years in total.
Do I have to learn a query language?
No. The search bar and filters cover most investigations. SQL is there for analysts who want it, with autocompletion, and the AI assistant can search the logs for you from a plain question.
Can I save searches I use often?
Yes. Saved searches keep the query with a name and description so you can run it again. Tabs let you keep several investigations open at the same time.
Related capabilities
- Log managementCollect logs from any source, correlate them in real time before storage, and keep hot and cold data searchable for up to 5 years.
- Threat detection600+ detection rules mapped to MITRE ATT&CK run on every event in real time. Tag false positives, mute noisy rules and see who is attacking whom.
- DashboardsDrag-and-drop security dashboards for logs and alerts. Ask the AI assistant to build or change one, and set auto-refresh for wall screens.
- AI assistantAsk questions about your security data, triage alerts, write rules and build dashboards with the UTMStack AI assistant. Use any of 10 model providers.
Protect your organization this week, not next quarter
Talk to an engineer today, or start using UTMStack in minutes.
Need to extend your SOC team?
Our analysts work as an extension of your security team: they cover nights and weekends, take alert overflow and back you up on hard incidents. Book a 30-minute call to plan the coverage you need.
Want to try UTMStack?
Click through the live demo in your browser with no sign-up, start a free cloud instance, or install the open source edition on your own server in about 30 minutes.