Collect, normalise and search security events from your entire environment — on infrastructure you control.
GuardsArm ingests and normalises telemetry from across your estate and keeps it inside your perimeter. Nothing is forwarded to a vendor cloud, and there is no per-gigabyte meter deciding what you are able to collect.
What is at stake
You cannot investigate what you chose not to keep, and per-gigabyte pricing makes that choice for you every month.
Self-hosted licensing removes the meter, so the sources teams normally drop under cost pressure — process creation, authentication, DNS — are the ones you can afford to keep. Those are also where intrusions are visible.
An investigation that reaches a gap in retention ends there. When the window is set against your obligation rather than an invoice, the answer is still in the data when someone finally asks for it.
Retention set deliberately, with normalised fields across every source, is what turns an audit request into a query instead of a reconstruction project.
Who carries this
Carried by the security lead, but the argument is usually had with finance — this is the module that changes security data from a recurring variable cost into infrastructure you already own.
The problem
Almost every hosted SIEM meters you on ingest — per gigabyte, per event, or per seat-plus-overage. The effect is predictable and well documented by anyone who has run one: teams stop sending logs. Debug-level application output goes first, then verbose audit sources, then whole classes of endpoint telemetry. The decision is made against a monthly invoice rather than against a threat model.
That is a real detection problem, because the sources teams drop under cost pressure are disproportionately the ones that matter during an intrusion. Process creation events are noisy. Authentication logs are enormous. DNS is both. Those three are also where most attacker activity is visible.
GuardsArm runs the index on your infrastructure under self-hosted licensing. What you collect becomes a security decision again, constrained by disk you already own rather than by a meter running in somebody else’s cloud.
The hardest part of a SIEM is not search. It is making ten thousand differently-shaped log lines answer the same question.
The second problem is normalisation. Raw logs are not a dataset; they are seventy-five incompatible dialects. A SIEM that stores them faithfully and leaves parsing to the analyst has moved the work rather than done it. GuardsArm decodes and normalises at ingest so that the field you search for means the same thing regardless of which system produced the event.
Capabilities
Linux and Unix (sshd, sudo, PAM, audit, systemd, cron, kernel), web (Apache, Nginx, ModSecurity), databases (MySQL/MariaDB, PostgreSQL, MongoDB, MSSQL, Redis), network gear (Cisco, Fortinet, Palo Alto, pfSense), cloud and identity (AWS CloudTrail, Azure, GCP, Microsoft 365, Okta, Entra ID, GitHub audit, Microsoft Graph and Defender), containers (Docker, Kubernetes), IDS and NSM (Snort, Suricata, Zeek), mail (Postfix, Dovecot, Exim), plus FTP, Samba, Kerberos, RADIUS, OpenVPN, Squid, HAProxy and VoIP.
ECS-aligned extraction puts user, source and destination address, process, file path, and event category and action on every event — so a query written once works across sources.
Events are classified OCSF-style into security, system activity, network activity, applications, cloud services and access management, which is what makes hunting across mixed telemetry tractable.
Lifecycle and retention policies keep storage bounded, so how long you keep security data is a decision you set against your compliance obligation rather than a bill you receive.
How it fits the platform
Everything else reads from this same normalised event stream — detection, correlation, the AI analyst, compliance evidence and reporting. Consistency at ingest is what makes every capability downstream of it trustworthy.
How it works
Six stages, all of them running inside your perimeter. Nothing in this pipeline makes an outbound call.
Agents forward endpoint and host telemetry; network gear, cloud providers and identity platforms deliver over syslog and their own APIs. Collection is pull-and-push, so an appliance that will only emit syslog and a cloud tenant that will only expose an audit API both land in the same place.
Every supported source is parsed into structured fields, pulling meaning out of log lines that were never designed to be machine-read. This is the unglamorous layer that decides whether everything downstream works.
Decoded fields are mapped to an ECS-aligned schema: user, source and destination address, process, file path, event category and event action. A query written against one source works against all of them, which is what makes cross-source hunting possible at all.
Events are classified OCSF-style into security, system activity, network activity, applications, cloud services and access management — the dimension analysts actually filter on before they know what they are looking for.
Normalised events are written to a search layer running on your own infrastructure, encrypted and authenticated throughout, with per-tenant isolation applied at write time rather than bolted on at query time.
Index rollover and retention policies age data out on a schedule you define. Storage stays bounded without anyone remembering to prune it, and the retention window is set against your compliance obligation rather than against a budget.
Coverage
Roughly seventy-five source formats, listed rather than counted — so you can check your own estate against them before a call rather than after one.
Sources outside this list are handled through custom source parsers. The source parsing is data rather than compiled code, which is the reason adding one does not require a platform release.
Normalisation
ECS-aligned extraction means one query spans sources that share nothing but the fact that something happened.
| Normalised field | What it holds | Why it matters |
|---|---|---|
| user.name | The acting principal | An sshd login, a Microsoft 365 sign-in and a sudo invocation all populate it. |
| source.ip / destination.ip | Both ends of the connection | Firewall denies, web requests and agent network events share the same two fields. |
| process.name / process.command_line | What executed | Process activity on Windows and on Linux resolves to one pair of fields. |
| file.path | What was touched | FIM changes, YARA hits and audit records are searchable together. |
| event.category / event.action | What kind of thing happened | The filter an analyst reaches for before they know the source. |
A hunt for a username across authentication, process execution and file access is a single query rather than three searches and a spreadsheet.
Background
Plain explainers on the underlying ideas, written for someone evaluating rather than buying.
Questions
No. your own infrastructure runs on your own servers or private cloud, and the platform is designed so telemetry never leaves your perimeter. That is the point of the architecture rather than a configuration option.
No. Licensing is self-hosted rather than metered per gigabyte or per event. That matters because per-gigabyte pricing tends to decide what an organisation is willing to collect, which is a security decision made on cost grounds.
Native index lifecycle management handles rollover and retention, so retention is a policy you set rather than unbounded growth. Retention length is worth setting against incident response needs rather than compliance minimums, since intrusions frequently predate short retention windows.
Yes. broad source coverage cover roughly 75 common sources, and anything emitting structured or syslog data can be ingested and normalised alongside them.
Works with
Every module runs in the same self-hosted stack and shares the same telemetry, severity model and response engine.
We will walk through the console, the deployment model and what it takes to stand it up in your environment.
