VECTORIO“Per-gigabyte pricing forces you to choose between cost and coverage”
Cut SIEM ingest, keep every log.
Pre-filter, aggregate and enrich logs before the SIEM; cheap full-fidelity retention and back-testing on one machine
- I pay per gigabyte, so I drop logs I may need after a breach.
- NIS2 wants incident evidence within 24 hours, but my retained logs are sampled or gone.
- Detection pipelines are non-reproducible, so I cannot back-test a new rule on last year's data.
- Pre-filter, aggregate and enrich logs before the SIEM; cheap full-fidelity retention and back-testing on one machine
- Re-run detections reproducibly on historical data
- Regulated SOCs keep log data in-jurisdiction
From today to the first result.
a SIEM billed per gigabyte
Logs that might matter after a breach are dropped to save cost, and NIS2 wants incident evidence within 24 hours (72 hours for the notification, one month for the final report).
Logs are filtered, aggregated and enriched locally before the SIEM: 1 billion rows in 32.1 ms. Everything stays available for replay and back-testing.
Put PROTOR in front of the SIEM for one noisy log source and compare the ingest volume.
one log sourceTransactions scored against each customer. Step by step.
Every transaction is compared with the customer's normal behaviour; risky ones are stopped, raised as a critical alert and filed as a case.
- Customer Profiles · Transaction StreamRandomDataProvider · RandomDataProvider
- Lookup CustomerLookup
- Compute Risk ScoreCompute Fields
- Fraud Detection GateQuality Gate
- Approved Transactions · Fraud AlertCSV Publisher · Alert
- Fraud Cases CSVCSV Publisher
customer-profiles → Generators.Random
tx-gen → Generators.Random
profile-lookup → ETL.Lookup
risk-compute → ETL.Compute
fraud-gate → Sync.QualityGate
approved-csv → CSV.Publisher
fraud-alert → ETL.Alert
fraud-csv → CSV.Publisher- Customer ProfilesLoads the customer reference table (average amount, frequency, risk tier).
- Lookup CustomerWaits until profiles are ready, then attaches each customer profile to its transaction.
- Compute Risk ScoreComputes a risk score from amount versus the customer norm.
- Fraud Detection GateRoutes anything with risk at or above 3.0 to a dead-letter table.
- Approved TransactionsWrites approved transactions.
- Fraud AlertRaises a critical FraudDetected alert for every routed row.
A real workflow from our end-to-end test suite; the designer view is illustrated.
What you get. From the first pilot.
Pre-filter, aggregate and enrich logs before the SIEM; cheap full-fidelity retention and back-testing on one machine
Re-run detections reproducibly on historical data
Regulated SOCs keep log data in-jurisdiction
Why your tools fall short.
Volume-priced commercial SIEMs punish retention and breadth.
JVM/Elastic/Spark-based log stacks need large clusters and ongoing tuning.
Cloud SIEMs conflict with data-sovereignty and air-gapped requirements.
- NIS2 Art. 21 (risk-management incl. incident handling) and Art. 23 (reporting)
- NIST SP 800-53 AU-2 / SI-4 logging and monitoring controls
- DORA for financial entities
Your pilot. Three steps.
Your data shape
Tell us what data you have, where it lives and what the result must be.
A scoped pilot
On your data and your hardware, with the success measure written down first.
A clear decision
You see the result against that measure — and keep every workflow and record.
Related roles in Regulated evidence.
Critical infrastructure and utilities OT data
OT analytics that stay in the plant.
Public-sector data platforms & smart city
City data under city control.
Healthcare & hospital data platforms
Hospital data, analysed in-house.
Manufacturing / Industry 4.0 IoT & quality data
Line data processed where it is born.
Bring us your hardest data problem. Let's solve it together.
A short pilot on your data and your hardware. We agree on what success looks like before we start.