Legion Security vs RunReveal

About RunReveal

RunReveal sells a unified platform that handles the security lifecycle from data ingestion through investigation and remediation. RunReveal unifies security data management with AI-powered detection and response. RunReveal brings data management, detection, and response into a single platform for security teams. RunReveal provides the core capabilities of a Security Information and Event Management (SIEM) platform, namely centralized log management, threat detection, alerting, and incident investigation.^{[1][2][4][5][6][13]}

RunReveal integrates natively with 80+ sources and supports Bring-Your-Own-Source functionality to unify logs in one searchable security data lake. RunReveal ingests from 80+ sources including AWS, GCP, Azure, Okta, GitHub, and custom logs. RunReveal connects to Slack, PagerDuty, Jira, ServiceNow, and any destination via webhooks for alerting and response. RunReveal stores both the original raw logs and the normalized, enriched versions. RunReveal monitors, normalizes, and enriches log data to prepare it for querying, search, and investigations. Data monitoring alerts users when logs stop flowing, schemas change, or volume spikes unexpectedly.^{[1][6][7][8][9]}

RunReveal's data pipelines let users filter, route, transform, and enrich security logs before they hit storage. RunReveal provides a visual pipeline builder for filtering, routing, and basic transformations. For advanced uses such as complex data reshaping or custom enrichment logic, transformations can be written in SQL or built-in functions can be used. RunReveal provides real-time pipeline metrics showing volume processed, filtering rates, routing destinations, processing latency, and error rates. RunReveal pipelines can enrich logs with threat intelligence, geolocation data from IP addresses, custom fields from lookup tables, and user or asset information from internal systems. RunReveal supports bring-your-own enrichment data from internal systems, custom threat feeds, employee databases, or any context source that helps investigations.^{[1][4][7][8][10]}

RunReveal includes pre-built SQL detections for common threats across AWS, Azure, GCP, GitHub, Okta, and 80+ integrations. Existing rules can be modified, or custom detections written, using standard SQL or Sigma format. RunReveal lets users preview detections against historical logs, validate logic with real events, and iterate on rules. RunReveal can deploy Sigma rules that evaluate events during ingestion rather than on a schedule. RunReveal offers both code-based and built-in options for detections. RunReveal routes alerts based on severity, tags, and custom logic that users define. AI can analyze a detection library against MITRE ATT&CK, identify gaps for specific attack techniques, or recommend rules based on log sources.^[1][11][12]

RunReveal's native AI chat and Model Context Protocol (MCP) server bring AI into security workflows to investigate alerts, analyze patterns, and create detections using natural language. RunReveal's AI correlates logs, enriches context, and surfaces relevant insights when users investigate alerts. RunReveal supports Claude, ChatGPT, Gemini, AWS Bedrock, and other major large language models. RunReveal provides audit logging for all AI queries and data access, role-based access controls for AI features, and support for pre-approved model lists.^[4][12]

RunReveal's AI agent automatically investigates alerts, pulls context from logs, and updates cases with findings. Specialized agents with custom prompts can be created for specific log types or detection categories. Agents can be configured with a chosen model and permissions, run on a schedule, or triggered on detection. RunReveal offers a built-in Weekly Threat Hunt agent template that runs automatically on a schedule.^[13]

RunReveal can be deployed in its SaaS cloud, in a customer cloud account, on a customer database, or completely on-premise. Bring-your-own-cloud lets customers deploy RunReveal in their own VPC for control over data residency, security, and compliance. RunReveal is SOC2 Type 2 certified and compliant with CCPA and GDPR. RunReveal supports RBAC, SSO, and Just-In-Time provisioning for access control. RunReveal uses usage-based pricing in which customers pay for the logs they store and query, not for ingestion.^[5][7]

SQL-powered dashboards and analytics cover core security metrics, detection performance, and operational KPIs. RunReveal's AI agent generates SQL queries from natural language prompts. Dashboard graphs can be sized S, M, L, or XL on a 12-column grid. RunReveal uses standard SQL as its query language. Cloud security monitoring covers misconfigurations, unauthorized access, and policy violations, with pre-built detections mapped to cloud security frameworks. Identity and access use cases cover detection of credential abuse, impossible travel, privilege escalation, and unauthorized access across Okta, Azure AD, and other identity providers.^{[1][4][5][6][7][12][13][14]}