Next-Gen SIEM
Cloud-native ingestion. Sub-second search. Agentic triage built in.
ManySignal's next-gen SIEM architecture handles petabyte-scale ingestion with schema-on-read for any log format, stores 12 months hot with unlimited cold, and includes the triage and response layer that legacy SIEMs require separate tools to deliver.
Architecture: where next-gen differs
| Capability | Gen-1 Cloud SIEM | ManySignal Next-Gen |
|---|---|---|
| Ingestion model | Batch or streaming with parser requirement | Streaming, schema-on-read, any format |
| Search latency (recent) | 5–30 seconds | Sub-second |
| Hot retention default | 30–90 days (expensive beyond that) | 12 months flat, any volume |
| Cold retention | Separate bucket + manual query | Unified index, consistent query interface |
| Data source onboarding | Parser development: days to weeks | Self-service: minutes with schema-on-read |
| Alert triage | Manual analyst queue | AI triage agent — confidence score on every alert |
| Investigation | Manual pivot across tools | Automated timeline assembly in 4 minutes |
| Response | Requires SOAR integration | Approval-gated response built in |
| Pricing | Per GB ingested | Flat per asset |
< 1s
search latency — last 24 hours
12mo
hot retention included at flat price
150+
pre-built data source connectors
∞
cold storage — no extra configuration
Next-gen SIEM technical capabilities
Schema-on-read for any log format
Ingest any structured log format immediately. Normalization happens at query time — no parser required before data is searchable.
Sub-second search across 100B+ events
Recent events search in under one second. Warm-tier events (up to 12 months) return results in 1–3 seconds.
Streaming ingestion with no backpressure
Kafka-compatible message queue absorbs log spikes without slowing your log sources or dropping events.
Unified hot and cold index
12 months of hot storage plus unlimited cold — both queryable with the same syntax. No separate cold query workflow.
Agentic triage built into the platform
Every detection finding is triaged automatically. The next-gen SIEM is not just a data store — it's a detection-to-response system.
Retention at flat pricing, not per-GB
Ingest 100 GB/day or 1,000 GB/day — your subscription cost doesn't change. Store 12 months of data without a retention cost conversation.
Legacy SIEM vs next-generation SIEM
Vendors use the "next-gen" label loosely. Here is the operational definition — the five architectural shifts that separate a legacy platform from a next-generation one.
Legacy SIEM examples
Splunk Enterprise · Micro Focus ArcSight · IBM QRadar · LogRhythm
Next-gen SIEM examples
CrowdStrike NG-SIEM · Google SecOps (Chronicle) · Panther · ManySignal
| Dimension | Legacy SIEM | Next-gen SIEM |
|---|---|---|
| Data model | Rigid schema-on-write; parser required before any search | Schema-on-read; structured logs searchable within minutes of connection |
| Query language | Proprietary DSL (SPL, AQL, ArcSight FlexConnector) with steep ramp | SQL, KQL, PPL, or Sigma — languages engineers already know |
| Pricing model | Ingest-metered per GB/day — every log source becomes a budget fight | Flat per-asset, per-user, or per-workload — retention conversations disappear |
| Ingestion architecture | Monolithic indexer clusters; scale = buy more indexers; upgrades are outages | Streaming (Kafka-native) + object storage; horizontally elastic; zero-downtime updates |
| AI capabilities | Bolt-on UEBA product with separate license and separate analyst workflow | Native AI triage on every alert; agentic investigation and evidence assembly built into the platform |
Eight criteria for replacing your legacy SIEM
Use this checklist on any vendor pitch. If a platform fails three or more of these criteria, it is a re-badged legacy product — not a next-gen replacement.
01
Schema flexibility
Can it ingest a new structured log source without a two-week parser project? Ask for a live demo: connect an unknown log format and search it in the same session.
02
Predictable pricing
Does the price scale on assets, users, or workloads — not on ingested GB? If you can't forecast next year's bill within 15% today, the pricing model is legacy.
03
Retention economics
12 months of hot, searchable retention should be the default, not an upsell. Cold retention should query with the same syntax as hot — no separate rehydration workflow.
04
Detection-as-code
Rules must live in Git, review through pull requests, and deploy through CI/CD. Sigma or YARA-L support is table stakes; UI-only rule authoring is a red flag.
05
Native AI triage
Every alert should be triaged by an agent that produces a verdict, a confidence score, and a citation-backed evidence chain — not a bolt-on ML add-on with its own console.
06
Investigation automation
The platform should build the incident timeline for you: pivot across identity, endpoint, network, and cloud without an analyst hand-writing joins across five indices.
07
Response built in
Approval-gated containment (disable account, isolate host, revoke token) should execute from the case view — not require a separate SOAR product and a second license.
08
Compliance evidence
Every triage decision, agent action, and analyst approval should produce an immutable, signed audit trail suitable for SOC 2, HIPAA, PCI, and FedRAMP AU-6 evidence packages.
Next-gen SIEM for HIPAA / HITECH environments
Healthcare has requirements a generic next-gen SIEM does not automatically satisfy. Before signing, confirm each item in the checklist to the right against the vendor's implementation — not their marketing.
- PHI handling: field-level tokenisation or redaction for any log carrying patient identifiers before AI or agent processing
- BAA availability: a signed Business Associate Agreement covering the SIEM tenancy, storage, and any managed service tier
- Six-year retention: HIPAA Security Rule §164.316(b)(2) requires audit evidence be retained for six years — at hot-tier query cost, not archive-restore cost
- Audit trail integrity: immutable, hash-chained audit records covering ePHI access events across EHR, imaging, and identity systems
- HITECH breach evidence: incident timelines that reconstruct the affected records, systems, and disclosures within the 60-day breach notification window
- Segmentation: role-based access so that admins operating the SIEM cannot themselves view ePHI content — only metadata
- MFA telemetry: authentication and step-up telemetry from Epic, Cerner, Workday, Okta, Entra normalized into one identity graph
- Ransomware readiness: detection coverage for the specific TTPs used against health systems (RDP brute force, ScreenConnect abuse, VPN CVE exploitation, EHR credential theft)
Next-gen SIEM — common questions
What makes ManySignal 'next-gen' vs. a modern cloud SIEM like Chronicle or Sentinel?
Cloud SIEMs like Chronicle and Sentinel solve the data scale problem — ingestion, storage, and search at petabyte scale. ManySignal solves what comes after: what do you do with the findings? The next-gen differentiator is the agentic layer — triage, investigation, and response built into the platform rather than requiring separate SOAR and analyst workflow tools.
What does schema-on-read mean and why does it matter?
Schema-on-read means logs are stored in their original format and normalized at query time, not at ingestion time. Traditional SIEMs require parser development before a new data source can be searched. ManySignal ingests any structured log format immediately — normalization happens when you query, not when you ingest. New data sources are searchable in minutes, not weeks.
How does the streaming ingestion architecture handle log spikes?
Ingestion uses a managed Kafka-compatible message queue that buffers upstream log spikes. Processing workers scale horizontally to handle bursts. Event ordering is preserved per-source. There is no backpressure to your log sources — ManySignal absorbs spikes without data loss or log source slowdown.
What is the search latency for recent events vs. older events?
Events ingested in the last 24 hours are indexed in a hot-tier store with sub-second search latency. Events between 24 hours and 12 months are in the warm tier with 1–3 second latency for most queries. Events older than 12 months are in cold storage with query latency of 10–60 seconds depending on scan size.
How does ManySignal handle multi-cloud environments with different log formats?
Each cloud provider has a dedicated normalized schema. CloudTrail, Azure Activity Log, and GCP Audit Log each have a pre-built parser that normalizes to ManySignal's common schema automatically. Cross-cloud queries run in a single query against the normalized schema — no per-cloud query translation required.
See the next-gen SIEM architecture in your environment
Connect a data source and we'll demonstrate schema-on-read ingestion, sub-second search, and the first triage results — in under two hours from connection.