PAGES
← all tools
◆ SIEM

RunReveal

Slack bot, notification upgrades, and more flexible data routing commercial

RunReveal is a security platform that stores, detects threats in, and helps teams respond to all their security data in one place.

Summary

RunReveal is a commercial SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. platform that unifies detection, investigation, data lake, and AI capabilities for platform engineers, with no stated licensing model. It operates as a service and its documentation positions it alongside other modern SIEM solutions. The project has had 11 releases tracked and had its last release 23 days ago.

RunReveal is a security platform that stores, detects threats in, and helps teams respond to all their security data in one place.

How RunReveal helps

Which hosts or accounts triggered a detection that actually matters right now?

correlates incoming log events against detection rules and surfaces the matches for investigation, rather than leaving the analyst to search raw logs

Where did an attacker or process go after the first suspicious event?

lets an investigator pivot from a single flagged event across the unified log data lake to trace the surrounding activity

How far back can an investigation reach before the trail runs cold?

keeps ingested logs in its data lake rather than a short rolling window, so historical events remain queryable during an investigation

Which log sources are actually feeding detections versus sitting unused?

unifies data lake storage with detection so ingestion and rule coverage are visible from the same place, showing where log sources exist but no rule is watching them

Can a written-language question about the logs get answered without hand-building a query?

applies its AI capabilities to translate an investigator's question into a query against the unified data, returning results without requiring the analyst to write it themselves

all 9 features, with the evidence for each →

Languages

Not documented

Features

9 capabilities across 4 capability groups

Built from RunReveal's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • RunReveal covers 3 of the 11 logs and telemetry capabilities we track.
  • RunReveal covers 1 of the 8 investigation and response capabilities we track.

What RunReveal offers you

  • Built-in AI assistant2
  • Role-based access control1
  • Scheduled jobs1
Log collection 1 feature Logs and telemetry since 2025
Third-party data source connectors shipped Ingests logs and audit data from a wide range of third-party platforms, cloud services, and security vendors via native connectors, webhooks, and polling methods. 45 releases · first seen Jun 2025

Shared capability: Log collection

release 45 total

  • Source-to-destination routing allows Reveald sources to route to specific destinations for data control. Slack bot, notification upgrades, and more flexible data routing · Aug 2026 · source · release history
  • Sandfly Security added as a new source type for ingestion. Slack bot, notification upgrades, and more flexible data routing · Aug 2026 · source · release history
  • WorkOS Audit Log source added to ingest audit logs via HTTPS webhook or S3 delivery. Slack bot, notification upgrades, and more flexible data routing · Aug 2026 · source · release history
  • WorkOS Events source added to poll the WorkOS Events API for auditing and monitoring. Slack bot, notification upgrades, and more flexible data routing · Aug 2026 · source · release history
  • Enables configurable outbound webhook allowlist to restrict permitted destinations Smarter detections, federated search, and agent polish · May 2026 · source · release history
  • Adds ability to disable or enable sources without deleting configuration Smarter detections, federated search, and agent polish · May 2026 · source · release history
Log search 1 feature Logs and telemetry since 2025
Log explorer and query management shipped Queries, filters, and saves log data with reusable SQL views, customizable table columns, and shareable query links. 13 releases · first seen Oct 2025

Shared capability: Log search

Also counts toward: Built-in AI assistant

release 13 total

  • Adds Federated object storage search to query external S3 buckets alongside RunReveal data directly from the UI Smarter detections, federated search, and agent polish · May 2026 · source · release history
  • Exposes health check results as a system table for direct querying. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
  • Displays all past queries, status, and execution times in the new Query History view. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
  • Adds the ability to cancel running queries from the query history page. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
  • Supports background execution of long-running queries via a dedicated work queue. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
  • Adds Custom Views allowing JSON log fields to be mapped to structured, queryable columns via dot notation paths. RBAC, Custom Views, + more! · Jan 2026 · source · release history
Metrics collection 1 feature Logs and telemetry since 2025
Security dashboards and ingestion metrics shipped Builds visual security graphs and monitors data pipeline health with throughput and drop rate tracking. 5 releases · first seen Sep 2025

Shared capability: Metrics collection

release

  • Displays pipeline step types inline in the configuration UI. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
  • Exposes health check results as a system table for direct querying. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
  • Adds multiple health checks per source with custom volume thresholds and notification frequency limits. RBAC, Custom Views, + more! · Jan 2026 · source · release history
  • Adds pipeline metrics tracking event throughput and drop rates for data processing visibility Dashboards, scheduled prompts, pipeline metrics, & more! · Sep 2025 · source · release history
  • Adds Dashboarding feature to create visual security graphs integrated with the AI chat agent Dashboards, scheduled prompts, pipeline metrics, & more! · Sep 2025 · source · release history
Incident case management 1 feature Investigation and response since 2025
Investigation and case management shipped Manages security investigations with status tracking, severity classification, artifact storage, and tagging. 8 releases · first seen Dec 2025

Shared capability: Incident case management

release 8 total

  • Slack bot (beta) enables alert delivery via a workspace-installed bot with rich Block Kit replies. Slack bot, notification upgrades, and more flexible data routing · Aug 2026 · source · release history
  • Tracks MTTD / MTTR metrics on the investigations overview page AI Investigations, Kubernetes Deployments, + more! · Apr 2026 · source · release history
  • Allows exporting investigation chat history as markdown for evidence and documentation AI Investigations, Kubernetes Deployments, + more! · Apr 2026 · source · release history
  • Enables auto-open investigations from detections to automatically create and open an investigation without manual triage AI Investigations, Kubernetes Deployments, + more! · Apr 2026 · source · release history
  • Adds Investigation classification to mark investigations as true positive, false positive, or inconclusive AI Investigations, Kubernetes Deployments, + more! · Apr 2026 · source · release history
  • Renders Mermaid diagrams inline within AI chat and investigations. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
Other / not yet classified 5 features Features we have not matched to a capability yet. A suggested match is marked.
Workspace administration and access control shipped Enforces fine-grained role-based permissions across UI modules, allows custom workspace branding, and configures remote server authentication. 12 releases · first seen Jun 2025

Also counts toward: Role-based access control

release 12 total

  • Allows Microsoft OAuth URL override for configurable login URLs in sovereign cloud deployments AI Investigations, Kubernetes Deployments, + more! · Apr 2026 · source · release history
  • Adds Bootstrap API key for pre-login provisioning of on-prem deployments via API key AI Investigations, Kubernetes Deployments, + more! · Apr 2026 · source · release history
  • Adds Kubernetes single-tenant deployments via Helm for EKS and GovCloud in self-hosted environments AI Investigations, Kubernetes Deployments, + more! · Apr 2026 · source · release history
  • Makes Email and object storage optional dependencies for self-hosted deployment AI Investigations, Kubernetes Deployments, + more! · Apr 2026 · source · release history
  • Logs all SCIM sync actions for compliance and troubleshooting. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
  • Introduces SCIM Directory Sync via WorkOS for automatic user provisioning and group-based role mapping. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
AI chat and analysis shipped Interacts with a native AI agent for security investigation, supports switching between LLM providers, and allows cancelling long-running queries. 10 releases · first seen Jun 2025

Also counts toward: Built-in AI assistant

release 10 total

  • Introduces IOC lookup tool to allow the investigation agent to pull external context during triage AI Investigations, Kubernetes Deployments, + more! · Apr 2026 · source · release history
  • Incorporates detection notes into agent context so analyst-written notes inform automated analysis AI Investigations, Kubernetes Deployments, + more! · Apr 2026 · source · release history
  • Provides a SQL query toggle in chat to view and audit agent queries with syntax highlighting AI Investigations, Kubernetes Deployments, + more! · Apr 2026 · source · release history
  • Enables streaming AI chat responses in real-time for Anthropic, AWS Bedrock, and OpenAI backends. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
  • Renders Mermaid diagrams inline within AI chat and investigations. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
  • Allows creating agents directly from detection rules or existing chat conversations. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
Detection management and tuning shipped Creates, tests, and tunes security detections with pre-save validation scans, MITRE technique mapping, and bulk subscription controls. 8 releases · first seen Aug 2025

release 8 total

  • Introduces Tier 1 managed detections with auto-triage enabled by default for high-signal findings Smarter detections, federated search, and agent polish · May 2026 · source · release history
  • Incorporates detection notes into agent context so analyst-written notes inform automated analysis AI Investigations, Kubernetes Deployments, + more! · Apr 2026 · source · release history
  • Allows cloning managed detections into standalone, editable detections. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
  • Enables AI Triage for Managed Detections with automatic Investigation creation. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
  • Enables testing and validating detections before saving them by scanning the last 30 days of logs for matches. Custom views, detection testing, & new data sources · Oct 2025 · source · release history
  • Adds MITRE techniques mapping on detections to tag coverage with tactics and techniques Dashboards, scheduled prompts, pipeline metrics, & more! · Sep 2025 · source · release history
Agent orchestration and management shipped Provides lifecycle controls, performance monitoring, and execution management for autonomous security agents. 6 releases · first seen Feb 2026

release

  • Adds the new runreveal CLI with an interactive agent chat TUI, auth profiles, and improved autocompletion while maintaining backwards compatibility for detection sync. UEBA, new sources, and a faster investigation workflow · Jul 2026 · source · release history
  • Makes agent metrics available including queue depth, usage, and error rate monitoring Smarter detections, federated search, and agent polish · May 2026 · source · release history
  • Introduces an Agent task killswitch for admins to clear agent task queues during noisy detections AI Investigations, Kubernetes Deployments, + more! · Apr 2026 · source · release history
  • Adds agent templates including Alert Tuning and Data Volume Anomaly Detection for automated security operations. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
  • Adds an Agent Widget on the homepage to display active agents, recent runs, and errors. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
  • Allows creating agents directly from detection rules or existing chat conversations. AI-Powered Agents, Async Queries, SCIM, + more! · Feb 2026 · source · release history
Custom AI prompts and LLM integrations shipped Standardizes analysis workflows with reusable custom prompts, automates markdown report delivery, and configures third-party LLM API keys. 5 releases · first seen Jul 2025

Also counts toward: Scheduled jobs

release

  • Adds AI Settings on the Settings page and brain emoticon in RunReveal AI Chat to specify specific large language model versions via Bring your own LLM Dashboards, scheduled prompts, pipeline metrics, & more! · Sep 2025 · source · release history
  • Adds Scheduled prompts to automate AI-powered reports delivered as markdown on custom intervals Dashboards, scheduled prompts, pipeline metrics, & more! · Sep 2025 · source · release history
  • Adds Custom Prompts feature in the native AI chat to standardize security analysis workflows with reusable templates and dynamic arguments Custom prompts, bulk subscribe to detections, and new alerts view · Aug 2025 · source · release history
  • Adds Gemini API Key configuration in workspace Settings under AI Model Providers to enable Google Gemini support (uses Gemini 2.5 Pro). New LLM provider support, 3 new sources, and AI chat sharing · Jul 2025 · source · release history
  • Adds AWS Bedrock integration using IAM Role Authentication with external ID for enhanced security, defaulting to Claude 3.5 Sonnet. New LLM provider support, 3 new sources, and AI chat sharing · Jul 2025 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface

Five scores for RunReveal, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail RunReveal puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Commercials

pricing & packaging history · ClickHouse vendor page

41 readings of ClickHouse's pricing page since Oct 2022, with 3 relaunches of its plan lineup and 16 changes to what its plans include — each one dated, compared with the reading before it, and explained for someone buying the tool.

Pricing and packaging history is included with Researcher and Business. See how every vendor we track sells, and how that has changed over time, using data we don't publish anywhere else.

See plans →

Website history

runreveal.com, every change

ClickHouse's home and pricing pages and 8 more pages as they looked each month from January 2023 to October 2026: 17 renders, 5 changes of tagline or palette. Step through them, play them, or put any two months side by side.

Website history is included with Researcher and Business.

See plans →

Releases

12 entries

  1. August 20261
  2. July 20261
  3. May 20261
  4. April 20261
  5. February 20261
  6. January 20261
  7. December 20251
  8. October 20251
  9. September 20251
  10. August 20251
  11. July 20251
  12. June 20251

    12 entries

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →