Hunters, RunReveal, Splunk and Sumo Logic

About RunReveal

RunReveal sells a unified platform that handles the security lifecycle from data ingestion through investigation and remediation. RunReveal unifies security data management with AI-powered detection and response. RunReveal brings data management, detection, and response into a single platform for security teams. RunReveal provides the core capabilities of a Security Information and Event Management (SIEM) platform, namely centralized log management, threat detection, alerting, and incident investigation.^{[1][2][4][5][6][13]}

RunReveal integrates natively with 80+ sources and supports Bring-Your-Own-Source functionality to unify logs in one searchable security data lake. RunReveal ingests from 80+ sources including AWS, GCP, Azure, Okta, GitHub, and custom logs. RunReveal connects to Slack, PagerDuty, Jira, ServiceNow, and any destination via webhooks for alerting and response. RunReveal stores both the original raw logs and the normalized, enriched versions. RunReveal monitors, normalizes, and enriches log data to prepare it for querying, search, and investigations. Data monitoring alerts users when logs stop flowing, schemas change, or volume spikes unexpectedly.^{[1][6][7][8][9]}

RunReveal's data pipelines let users filter, route, transform, and enrich security logs before they hit storage. RunReveal provides a visual pipeline builder for filtering, routing, and basic transformations. For advanced uses such as complex data reshaping or custom enrichment logic, transformations can be written in SQL or built-in functions can be used. RunReveal provides real-time pipeline metrics showing volume processed, filtering rates, routing destinations, processing latency, and error rates. RunReveal pipelines can enrich logs with threat intelligence, geolocation data from IP addresses, custom fields from lookup tables, and user or asset information from internal systems. RunReveal supports bring-your-own enrichment data from internal systems, custom threat feeds, employee databases, or any context source that helps investigations.^{[1][4][7][8][10]}

RunReveal includes pre-built SQL detections for common threats across AWS, Azure, GCP, GitHub, Okta, and 80+ integrations. Existing rules can be modified, or custom detections written, using standard SQL or Sigma format. RunReveal lets users preview detections against historical logs, validate logic with real events, and iterate on rules. RunReveal can deploy Sigma rules that evaluate events during ingestion rather than on a schedule. RunReveal offers both code-based and built-in options for detections. RunReveal routes alerts based on severity, tags, and custom logic that users define. AI can analyze a detection library against MITRE ATT&CK, identify gaps for specific attack techniques, or recommend rules based on log sources.^[1][11][12]

RunReveal's native AI chat and Model Context Protocol (MCP) server bring AI into security workflows to investigate alerts, analyze patterns, and create detections using natural language. RunReveal's AI correlates logs, enriches context, and surfaces relevant insights when users investigate alerts. RunReveal supports Claude, ChatGPT, Gemini, AWS Bedrock, and other major large language models. RunReveal provides audit logging for all AI queries and data access, role-based access controls for AI features, and support for pre-approved model lists.^[4][12]

RunReveal's AI agent automatically investigates alerts, pulls context from logs, and updates cases with findings. Specialized agents with custom prompts can be created for specific log types or detection categories. Agents can be configured with a chosen model and permissions, run on a schedule, or triggered on detection. RunReveal offers a built-in Weekly Threat Hunt agent template that runs automatically on a schedule.^[13]

RunReveal can be deployed in its SaaS cloud, in a customer cloud account, on a customer database, or completely on-premise. Bring-your-own-cloud lets customers deploy RunReveal in their own VPC for control over data residency, security, and compliance. RunReveal is SOC2 Type 2 certified and compliant with CCPA and GDPR. RunReveal supports RBAC, SSO, and Just-In-Time provisioning for access control. RunReveal uses usage-based pricing in which customers pay for the logs they store and query, not for ingestion.^[5][7]

SQL-powered dashboards and analytics cover core security metrics, detection performance, and operational KPIs. RunReveal's AI agent generates SQL queries from natural language prompts. Dashboard graphs can be sized S, M, L, or XL on a 12-column grid. RunReveal uses standard SQL as its query language. Cloud security monitoring covers misconfigurations, unauthorized access, and policy violations, with pre-built detections mapped to cloud security frameworks. Identity and access use cases cover detection of credential abuse, impossible travel, privilege escalation, and unauthorized access across Okta, Azure AD, and other identity providers.^{[1][4][5][6][7][12][13][14]}

About Splunk

Splunk sells a data platform for security, observability, and AI, and says the platform unifies petabyte-scale machine data wherever it lives.

Splunk says its unified platform gives teams cross-domain context for security, observability, and AI and keeps telemetry where it lives. Splunk says teams can search and analyze data where it lives to reduce costs. Splunk says its platform preserves full access and context for AI and analytics without the ingest tax or unnecessary data movement.

On the security side, Splunk says adversaries using AI are shrinking remediation windows from months to minutes. Splunk says its answer combines unified data, advanced TDIR, and AI agents that enable experts to mitigate threats across any attack surface. Splunk says teams can use AI agents and assistants to predict and prevent issues, eliminate toil, and accelerate remediation safely. Splunk describes a SOAR system that integrates orchestration, playbook automation, and case management. Splunk names Splunk Enterprise Security, Splunk IT Service Intelligence, and the Splunk Common Information Model as Splunk solutions that use pre-written macros.^[1][12][17]

Splunk describes AI Assistant in Security as available to cloud customers of Splunk Enterprise Security, and says it automates repetitive steps and guides analysts in daily investigation workflows. Splunk describes a Triage Agent, in alpha, that evaluates, prioritises, and explains alerts. Splunk describes an Automation Builder Agent, in alpha, that turns natural language into SOAR playbooks. Splunk describes a Malware Threat Reversing Agent for customers of Splunk Attack Analyzer that summarizes threats by breaking down malicious scripts.^[18]

Splunk Cloud Platform is described as a way to collect, index, and visualize data in the cloud. Splunk Enterprise is described as collecting, indexing, and visualizing data using an on-premises engine. Splunk describes Splunkbase as the place to discover, share, and install apps and add-ons with the Splunk community. Splunk says teams can connect and act on data through integrations and apps on Splunkbase, across cloud, SaaS, IT, and machine data from OT and IoT. Splunk says teams can instrument with native OpenTelemetry support, SDKs, and agents.^[12]

Splunk describes Federated Search as the unifying search layer across the data estate, covering Splunk-managed locations and supported customer-managed stores such as Amazon S3 and Snowflake. Splunk describes Splunk AI Assistant as a natural-language entry point to the search workflow. Agent Mode is available in Splunk AI Assistant 2.1 or later for supported Splunk Cloud Platform and Cloud Connected deployments running Splunk platform 10.1 or later. Splunk describes the Splunk AI Toolkit as providing step-by-step guided workflows to build and deploy models for common business challenges.^[19][20]

Splunk says Splunk Edge Processor applies cryptographic functions to data in real time as the data flows within an on-premises environment. Splunk says ODBC-enabled apps such as Microsoft Excel, Power BI, and Tableau can connect to the Splunk platform, with SQL queries used to interact with the server. Splunk describes Splunk Log Observer Connect as an integration that lets logs on Splunk Enterprise or Splunk Cloud Platform be queried and associated with Related Content in Splunk Observability Cloud.^{[12][19][21][22]}

On the observability side, Splunk says teams can use AI SRE agents to isolate root causes across environments and identify targeted fixes such as rollbacks or capacity adjustments. Splunk says teams can track LLM token usage with visibility and attribution. Splunk describes a healthcare organization using the Splunk platform to monitor and analyze logs generated from medical devices.^{[12][13][14][19][21]}

About Sumo Logic

Sumo Logic sells a platform that combines telemetry pipeline control, log analytics, SIEM and DojoAI agents. Sumo Logic says it enables digital organizations to transform massive amounts of data into actionable insights to prevent and remediate modern security and cloud operations challenges. The Sumo Logic Intelligent Operations Platform is built to address the increasing complexity of modern cybersecurity and cloud operations challenges.^[6][7]

Sumo Logic SIEM provides security analysts and SOC managers with enhanced visibility across the enterprise to understand the scope and context of an attack. Sumo Logic SIEM parses, maps and creates normalized records from structured and unstructured data, and correlates detected threats to reduce log events. Sumo Logic UEBA baselines user and entity behavior and trains models on historical data to reduce false positives. Sumo Logic SIEM has Detection-as-Code support that helps security teams version and manage SIEM rules in GitHub. The SOC Analyst Agent automatically analyzes alerts, evaluates related activity and delivers an evidence-backed verdict. Sumo Logic SIEM Automation Service allows playbooks to run manually or automatically when an insight is created or closed.^[2][6][8]

Sumo Logic Cloud SOAR delivers SOAR functionality in private cloud, single cloud, multi-cloud or hybrid cloud environments. In the War Room, security analysts get a complete, chronological and detailed picture of a specific incident process. Sumo Logic offers hundreds of out-of-the-box actions and playbooks, and the Sumo Logic team can develop connectors.

Sumo Logic DojoAI puts agentic AI to work across security and cloud operations. Sumo Logic describes a multi-agent AI platform built to power security operations and incident response. Mobot lets users talk to their data in plain language. The Summary Agent automatically explains what triggered an Insight, highlighting key signals and context. Sumo Logic MCP Server connects external AI clients to Log Analytics and SIEM. DojoAI uses foundation models hosted through Amazon Bedrock. Sumo Logic says customer data is never used to train AI models.^[10]

Logs for Security collects and analyzes cloud-specific logs. Logs for Security integrates logs from AWS, Google Cloud and Azure. Sumo Logic offers pre-built PCI compliance dashboards. Sumo Logic collects log data from cloud and on-premises systems to analyze and resolve issues before they affect applications and systems. Sumo Logic describes an integrated observability platform for application data including logs, metrics and traces. Sumo Logic says its Kubernetes solution works for any Kubernetes setup on premise, AWS, Azure and GCP. Sumo Logic provides native integrations with data sources for Kubernetes: Prometheus, OpenTelemetry, FluentD, Fluentbit and Falco.^[2][11][12]

Customers pay only for the data being used so they can ingest everything without budget waste. Sumo Logic positions one package for small-to-medium-sized DevOps and SecOps teams requiring ad-hoc investigation and troubleshooting. Sumo Logic positions a different package for maturing security teams looking for real-time threat detection, investigation and response. Sumo Logic says thousands of enterprises trust it. MSSP and other parent org admins can enable or disable Mobot and App Catalog for individual child orgs. Sumo Logic has a Claude Compliance API integration that pulls Claude Enterprise activity logs and Claude Platform activity logs into Sumo Logic.^[6][10]

Sumo Logic Professional Services Cloud SIEM Implementation Services enable customers to rapidly deploy, operationalize, and realize value from their Sumo Logic SIEM investment.^[6][11][14]