Security Data Platform
One pipeline from raw log to governed action
ManySignal ingests telemetry from hundreds of sources, normalizes it into a common schema, builds a temporal entity graph, and hands structured context to detection and AI layers — all without you managing a SIEM cluster.
<2 s
median ingestion lag
10 PB+
retention tested
200+
built-in connectors
0.003%
dedup miss rate
Structured ingestion, not just forwarding
Every event is parsed against a vendor-specific schema before it touches the pipeline. Fields are renamed, typed, and enriched with geo-IP and ASN data at the gate. Malformed events go to a dead-letter queue and surface in the connector health dashboard — not silently dropped.
Idempotency and exactly-once delivery
Connectors stamp a deterministic key derived from source, event ID, and timestamp. The ingestion layer deduplicates at the gate, so replaying a connector after an outage never double-counts an alert or inflates baselines.
Hot, warm, and cold tiers
Recent 90 days are indexed for sub-second search. Older data moves to compressed parquet on object storage, queryable on demand via columnar scan. Retention policy is per-source, per-tenant, expressed in YAML and auditable.
What the data platform handles so you don't have to
Schema normalization
AWS CloudTrail, Okta, CrowdStrike, Entra ID, and 200 more are mapped to a common event model before anything touches detection logic.
Silent connector detection
If a connector stops sending data, an internal watchdog fires an alert within the window you configure — no manual health checks.
Field-level encryption
PII fields — email, IP in regulated regions, user agent — can be encrypted at rest with per-tenant keys managed in your own KMS.
Streaming and batch modes
Real-time streaming for EDR and auth events; scheduled batch for SaaS audit logs that only export hourly. Both land in the same normalized store.
Connector SDK
Define a new source in a YAML manifest: auth method, pagination strategy, field mappings, and backfill window. No code required for most REST APIs.
Data residency controls
Pin tenants to a specific cloud region. Ingestion, storage, and processing never leave the designated boundary unless you explicitly configure cross-region replication.
Security Data Platform — FAQ
Does ManySignal replace my SIEM?
For most teams, yes. Ingestion, normalization, retention, search, and detection all run on the same pipeline. If you have a sunk-cost SIEM, you can also forward ManySignal verdicts into it rather than ripping it out immediately.
How do you handle high-volume sources like VPC flow logs?
High-volume sources use a sampling + aggregation path: micro-batch windows collapse repeated flows into counters, so detection still has behavioral signal without storing every individual packet row.
What happens if my connector drops events during an outage?
The dead-letter queue retains failed events for 7 days. You can replay from the DLQ or trigger a backfill from the connector's native API if the source supports it.
Can I bring my own Kafka or S3 bucket?
Yes. The platform accepts events via a Kafka-compatible consumer endpoint and can read directly from S3-compatible object storage buckets on a schedule you define.
What event schema does ManySignal use for normalisation?
ManySignal normalises all events to an OCSF-aligned schema (Open Cybersecurity Schema Framework). OCSF base classes (Authentication, Network Activity, API Activity, Process Activity) are extended with ManySignal-specific fields for entity graph references and behavioural scores.
How does the platform ensure event ordering and latency guarantees?
Events are processed with at-least-once delivery semantics. Deduplication at the ingestion gate prevents double-processing. Timestamp-ordered storage in the event store ensures that temporal queries return results in causal order even when events arrive out of order due to network latency.
Can we access raw normalised events for our own analytics workloads?
Yes. The data export API provides read access to normalised event streams in OCSF JSON format. Streaming exports can be delivered to an S3 bucket, a Kafka topic, or a BigQuery dataset on a schedule. This enables customers to run their own analytics on the same data that feeds ManySignal's detections.
What is the SLA for the cloud-hosted data platform?
The cloud-hosted data platform SLA is 99.9% availability for the ingestion API and 99.5% for the query API. SLA windows exclude planned maintenance (announced 7 days in advance). SLA credits apply for availability misses confirmed by the status page incident record.
Does ManySignal support OpenTelemetry for log ingestion?
Yes. The platform exposes an OTLP-compatible endpoint that accepts logs, traces, and metrics from OpenTelemetry collectors. This allows teams already running OTel infrastructure to route security-relevant telemetry to ManySignal without an additional connector.
Start with the data layer
See how ManySignal ingests your existing sources and makes them immediately useful for detection and investigation.