UTMStack

Collect every log and catch threats the moment they arrive

UTMStack takes in logs from every system you run, turns them into one standard format and checks each event against 600+ detection rules and millions of threat indicators before it is stored. It keeps every event in about 70% less disk than OpenSearch- or Elasticsearch-based systems, and maps it to the compliance controls it proves.

Talk to an expertStart free trial Try it in the live demo Read the docs

  1. From every source

    Firewalls, servers, endpoints and cloud services, over the agent, syslog or APIs

  2. Ingested and normalized

    Each log kept raw and turned into one standard event

  3. Correlated in real time

    600+ detection rules and millions of threat indicators, before storage

  4. Alerted, stored and scored

    Alerts raised at once; every event stored compressed and evaluated for compliance

An illustration with sample events: what you connect, how each log is checked, and where it goes. Counts are not measured rates.

  • Correlation before storage

    Every event is checked against 600+ detection rules while it is processed, before it is written to disk. Alerts fire in real time instead of waiting for indexing and slow searches.

  • Millions of threat indicators

    Known bad IP addresses, domains, web addresses and file hashes from ThreatWinds are matched against every event and refreshed every hour.

  • About 70% less storage

    Column storage on ClickHouse needs about 70% less disk than OpenSearch- or Elasticsearch-based systems for the same logs, so you keep more for longer on less hardware.

  • Every event kept

    UTMStack stores all events, not only the ones tied to alerts, and keeps the original log line next to the parsed version for your audit trail.

  • Hot and cold, up to 5 years

    Recent data stays on fast disks and older data moves to lower-cost storage. Both answer the same searches, with no snapshot to restore.

  • Compliance from the same logs

    644 controls across 9 frameworks, from HIPAA and PCI DSS to CMMC and ISO 27001, are checked automatically from the logs you already collect.

Every source, in one standard format

Connect firewalls, servers, endpoints and cloud services through the UTMStack agent, syslog (including CEF and LEEF), cloud APIs or the HTTP intake. Pipelines, also called parsing filters, read each raw log, pull out the fields that matter and write them into one standard event with an origin and a target. A rule written once then works for every vendor, and the original line is kept for your audit trail.

  • Built-in pipelines for every included integration, from FortiGate to Microsoft 365
  • Build or edit a pipeline in the interface, write it as code, or ask the AI assistant
  • Drop noisy logs you never need before they use disk
FortiGate firewallWindows serverAWS CloudTrailLinux server

Raw log, as receivedsyslog

date=2026-10-14 time=09:41:07 devname="vpn-gw-01" logid="0101039426" type="event" subtype="vpn" action="ssl-login-fail" remip=203.0.113.45 user="j.alvarez" reason="sslvpn_login_permission_denied"

Pipeline steps

  1. Read key-value pairs
  2. Rename fields
  3. Convert types

Standard event

dataType
firewall-fortigate-traffic
origin.ip
203.0.113.45
origin.user
j.alvarez
target.host
vpn-gw-01
action
ssl-login-fail
actionResult
failure
raw
original line kept
An illustration with sample logs in each vendor's own format. The pipeline reads the fields out of every raw line and writes them into one standard event, so a single detection rule covers all of them.

Threats caught while the log streams in

Most security information and event management (SIEM) tools write logs to disk first and search them later, on a schedule. UTMStack runs its 600+ detection rules on each event as it is processed, then stores it. Rules can also look back over recent events, so a pattern such as ten failed logons followed by a success raises an alert on the very event that completes it.

  • 600+ built-in rules, each mapped to a MITRE ATT&CK technique
  • Rules read the standard event, so one rule covers every vendor
  • Edit the built-in rules or write your own

Events arrivingeach one checked, then stored

  1. wineventloglogon203.0.113.45svc-backup on dc01Alert
  2. wineventlogprocess-createdwks-0457outlook.exeStored
  3. wineventloglogon-failed203.0.113.45svc-backup on dc01Stored
  4. wineventloglogon-failed203.0.113.45svc-backup on dc01Stored
  5. firewall-fortigate-trafficdeny192.0.2.20010.20.0.10:3389Stored
  6. wineventloglogon-failed203.0.113.45svc-backup on dc01Stored
  7. wineventloglogon-failed203.0.113.45svc-backup on dc01Stored
  8. awsGetObject10.30.0.12backups-prod bucketStored

Detection rule

Windows: Multiple Logon Failure Followed by Logon Success

MITRE ATT&CK T1110, Brute Force

Failed logons for the same account, from the same address, in 5 minutes10 of 10

Then a successful logon from that address

No alert yet

The rule fires on the event that completes the pattern.

Alert raisedHigh

10 failed logons, then a success, for svc-backup on dc01 from 203.0.113.45.

Raised while the event was processed, before it was written to storage.

An illustration with sample events and one of the built-in detection rules. Every event is checked against the rules as it arrives, so the alert fires on the event that completes the pattern.

Millions of threat indicators, checked against every event

UTMStack loads millions of known bad IP addresses, domains, web addresses and file hashes from ThreatWinds, linked to malware, botnets, phishing, brute force and scanning. The same engine that runs the detection rules looks up every value in every event against them, so a connection to a command-and-control server raises an alert the moment the firewall logs it. Empty values are ignored, which cuts false matches.

  • Indicators refreshed every hour, so new threats reach your detections quickly
  • Matched in real time on the stream, not in a later search
  • Add other sources, such as MISP or OpenCTI, with a plugin

Looking uptarget.ip198.51.100.146

Checked 8Matches 1

IP addressesDomainsWeb addressesFile hashes

Millions of known bad indicators from ThreatWinds, refreshed every hour. Each dot stands for many.

  1. 198.51.100.146Match: known command-and-control server. wks-0457 connected to it.Alert raised
  2. 3b7e09c4…f21a6d58No match. Event from wineventlog stored.Stored
  3. login.northwind.exampleNo match. Event from o365 stored.Stored
An illustration with sample values. Every address, domain, web address and file hash in an incoming event is looked up in the threat intelligence set; a match raises an alert in real time, the rest is stored.

About 70% less storage than OpenSearch or Elasticsearch

Storage runs on ClickHouse, a fast column-based database. Each field's values are stored together and compressed, so the same logs need about 70% less disk than an OpenSearch- or Elasticsearch-based system. Recent data stays in a hot tier on fast disks, older data moves to a cold tier on lower-cost storage, and both answer the same searches. As your data grows, add disk to the cold tier or move to a larger server.

  • Retention up to 5 years, set by your policy or regulator
  • Cold data stays searchable without restoring a snapshot
  • The original log is kept next to the parsed event

The same logs, stored two ways

30 days of logs written

OpenSearch or Elasticsearch index100%

UTMStack column storage30%

about 70% less disk

Searchorigin.ip = 203.0.113.45over the last 3 years

Hot tier

fast disks, recent days

14 events

Cold tier

lower-cost storage, up to 5 years

212 events

Both tiers answer the same search. Nothing to restore first.

An illustration of relative size. Column storage keeps each field's values together, so values that repeat across millions of events, such as host names and actions, compress far better than whole documents. The exact saving depends on your data.

Logs mapped to compliance controls automatically

The logs that feed detection also prove compliance. UTMStack reads the evidence behind each control, such as multi-factor sign-ins, disk and connection encryption, or audit logging, and marks the control compliant or at risk. Controls are defined once in a library based on NIST SP 800-53, so one check counts toward the matching clause of every framework that requires it.

  • 644 of 967 controls are checked automatically from your logs
  • HIPAA, PCI DSS 4.0, CMMC 2.0, GDPR, ISO/IEC 27001:2022, NIST SP 800-171, NIST CSF 2.0, SOC 2 and Banking Audit
  • Reviewers can confirm or override any result, and reports export as PDF
Multi-factor authenticationDisk encryptionEncrypted connectionsAudit logging

Log evidence

UserLoggedIn

MFA used: yes

Microsoft 365

Control

Multi-factor authentication

Compliant

All 312 administrator sign-ins used MFA

Counts toward

  • HIPAA§164.312(d)
  • PCI DSS8.4
  • CMMCIA.L2-3.5.3
  • GDPRArt.32
  • ISO 27001A.8.5
  • NIST 800-17103.05.03
  • NIST CSFPR.AA-03
  • SOC 2CC6.1
  • Banking 

644 of 967 controls are checked automatically from your logs

An illustration with sample evidence. UTMStack reads the log that proves a control, marks the control compliant or at risk, and counts it toward the clause of every framework that requires it. Clause numbers are each framework's own.

Test before you save

The playground takes a sample log and shows exactly how a pipeline parses it and which rules would fire. You catch a wrong field name or a noisy rule before it reaches production.

The 9 frameworks UTMStack scores

Controls are defined once in a library based on NIST SP 800-53, so evidence collected for one framework counts toward the others.

  • Banking Audit

    For banks, credit unions and other financial institutions that must prove they log, watch and act on security events.

    Controls
    80
    Edition
    Enterprise

  • CMMC 2.0

    For companies in the US defense supply chain that handle federal contract or controlled unclassified information.

    Controls
    339
    Edition
    Community and Enterprise

  • GDPR (EU 2016/679)

    For any organization that collects or processes personal data of people in the European Union.

    Controls
    12
    Edition
    Community and Enterprise

  • HIPAA

    For US healthcare providers, health plans and their partners that store or handle patient health information.

    Controls
    69
    Edition
    Enterprise

  • ISO/IEC 27001:2022

    For organizations of any size or sector that run, or want to certify, an information security management system.

    Controls
    29
    Edition
    Enterprise

  • NIST SP 800-171 Rev 3

    For contractors and other non-federal organizations that store or process US controlled unclassified information.

    Controls
    113
    Edition
    Enterprise

  • NIST Cybersecurity Framework 2.0

    For any organization that wants a common, widely used way to manage and measure cybersecurity risk.

    Controls
    76
    Edition
    Enterprise

  • PCI DSS 4.0

    For any business that stores, processes or transmits payment card data.

    Controls
    155
    Edition
    Enterprise

  • SOC 2

    For service providers, such as software and cloud companies, that hold customer data and need an independent audit report.

    Controls
    34
    Edition
    Enterprise

Questions buyers ask

What does correlation before storage mean?

UTMStack checks each event against detection rules and threat indicators while it is being processed, before it is written to storage. Traditional SIEM tools store first and search later, which adds delay and load. Correlating first is how UTMStack raises alerts in real time.

How does UTMStack use about 70% less storage than OpenSearch or Elasticsearch?

UTMStack stores events in ClickHouse, a column-based database. The values of each field are stored together and compressed, so values that repeat across millions of events, such as host names, actions and data types, take very little space. OpenSearch and Elasticsearch keep each event as a full document along with the indexes built over it, which needs more disk. The exact saving depends on your data.

What threat intelligence are my logs matched against?

Feeds from ThreatWinds with millions of known bad IP addresses, domains, web addresses and file hashes linked to malware, botnets, phishing, brute force attacks and scanning. The same engine that runs the detection rules matches every event against them in real time, and the feeds refresh every hour. You can add other sources, such as MISP or OpenCTI, with a plugin.

Which compliance frameworks do my logs map to?

Nine: HIPAA, PCI DSS 4.0, CMMC 2.0, GDPR, ISO/IEC 27001:2022, NIST SP 800-171 Rev 3, NIST CSF 2.0, SOC 2 and Banking Audit. UTMStack checks 644 of its 967 controls automatically from your logs, and a control checked once counts toward every framework that requires it. CMMC 2.0 and GDPR are included in the free Community edition; the others need Enterprise.

How long can I keep logs?

You set retention, up to 5 years. UTMStack keeps recent data in a hot tier and older data in a cold tier, and both stay searchable without restoring snapshots. Disk needs depend on how many sources you connect and how long you keep data hot.

Can I bring logs from a source that is not in the integration list?

Yes. Any source can be added as a custom integration over syslog, as JSON, or through the HTTP intake endpoint. You then build a pipeline for it in the interface, in code or with the AI assistant, and test it in the playground.

Does UTMStack store only alerts or all logs?

All of them. UTMStack keeps every event and its original raw log, not only the events tied to alerts. Investigators get full context and auditors get complete records.

How much hardware does it need?

It depends on the number of data sources and how long you keep data in the hot tier. Because storage needs about 70% less disk than index-based systems, deployments stay small as you grow. The documentation lists sizing tiers, and our team can size a deployment with you.

Related capabilities

Protect your organization this week, not next quarter

Talk to an engineer today, or start using UTMStack in minutes.

Need to extend your SOC team?

Our analysts work as an extension of your security team: they cover nights and weekends, take alert overflow and back you up on hard incidents. Book a 30-minute call to plan the coverage you need.

Talk to an expertSOC extension

Want to try UTMStack?

Click through the live demo in your browser with no sign-up, start a free cloud instance, or install the open source edition on your own server in about 30 minutes.

Start free trialLive demoInstall free