RunReveal

Announcing RUNWAY, our first security conference. September 29, San Francisco. One day, an intimate group of security practitioners, and real talks about where security ops is headed. Early bird reg is open now 👇 runway.runreveal.com

RunReveal is a proud sponsor of @ClickHouseDB Open House! We're excited to meet other ClickHouse users, share with them how we use ClickHouse to power RunReveal, and meet fellow techies in SF. (And don't miss @Caust1c 's talk!) May 26–28, 2026 | Convene, 100 Stockton St, San Francisco

New in RunReveal: search raw logs directly from any S3-compatible object storage bucket 💥 No ingestion required. Query it like any other table. Works with our AI agent out of the box. blog.runreveal.com/search-s3-obje…

Our very own @Caust1c is speaking at @ClickHouseDB's Open House conference next week May 26-28! Alan is sharing insight into how the team at RunReveal has operated ClickHouse across Cloudflare, Segment, and now a purpose-built security data platform handling petabyte-scale event logs. His session covers a decade of real schema decisions, operational lessons, and a technical breakdown of why ClickHouse's architecture outperforms legacy approaches for security analytics at scale.

@ejcx_ shows how to use RunReveal's Tier 1, high-signal detections to build a robust and automatic detection and response program in minutes.

If your SIEM isn't: - Giving you free filtering - Automatically investigating your alerts with an AI agent - Allowing you to enrich your alerts with other tools - Enabling you to make your own AI agent - Capable of running in your VPC ...it might be time to take a look at RunReveal 👀

💥 Pipelines just got more powerful 💥 RunReveal now lets you selectively route logs to object storage destinations; instead of sending everything everywhere, you can match specific log sources and send only what you need to where you need it. This is part of a bigger vision: one platform where your data pipelines, detections, and investigations all talk to each other — without the compatibility headaches. Check out the full walkthrough on the blog 👇 blog.runreveal.com/pipelines-obje…

This is a very good idea luma.com/s40m3fxc @RunReveal hosting a "play against a Chess grandmaster" for their #RSAC2026 booth

@NVIDIAGTC starts tomorrow. Find Docker at Booth 3207 and at the Docker + @ClickHouseDB + @RunReveal RunReveal meetup - March 16, 7:30 PST. Stop by and bring your hardest AI infrastructure questions! See you in San Jose. Register for the meetup here: luma.com/xoq2dz0l

We're co-hosting a rooftop after party for BSidesSF 2026 with @RunReveal, @csideai, @tracebit_com, and @SocketSecurity. March 22. SF. 250+ people, no pitches, good vibes. RSVP required 👇

RSA week is almost a month out! 🔐 Find us at Booth #2337, South Hall all week. We've also got events on Sunday + Tuesday worth checking out: 📍 Sunday rooftop after party → luma.com/s9qdxmxm 📍 Tuesday Nacho Party Security happy hour → luma.com/x1vmddgr?utm_s… Come say hi 👋

Security teams have a data hoarding problem — and it's not their fault. When you never know which log will matter, you collect everything. When you collect everything, you need to store it for sometimes over a year for compliance reasons. When you potentially store years of data, you need it to be searchable in seconds during an incident. The two solutions most teams reach for — heavy indexing or splitting data across S3/Athena/BigQuery — both create new problems. Costs spike, stacks get fragmented, and investigations slow down. What does @ejcx_ think the real path forward is? Simplifying your stack, understanding your actual business risks, and recognizing that fast search and cheap storage will always be a trade-off. (And anyone promising both is probably hiding something!)

Security teams shouldn't have to choose between coverage and cost. @lumosidentity didn't. Full-stack coverage across cloud, product security, and detection & response — logs flowing in two days, AI handling triage, broader detections without the noise. Read about their journey here: runreveal.com/case-studies/l…

The worst time to meet your legal team is during an active security incident. @ejcx_ walks through 3 free steps to prepare for your next incident (that don't require any budget): → Build relationships now → Create your response plan → Align on transparency blog.runreveal.com/prepare-for-se…

RunReveal now supports Just-In-Time (JIT) provisioning 🎉 Automatically create user accounts in RunReveal when users first authenticate via SSO, eliminating the need for manual user invitations. Streamlines user onboarding by allowing users to access RunReveal immediately upon their first SSO login, provided they meet the configured criteria ✅ Read more about how it works here: #just-in-time-jit-provisioning" target="_blank" rel="nofollow noopener">docs.runreveal.com/reference/sing…

"I need devs in our SIEM but they can't see auth logs" "Our custom logs are unparsable JSON blobs" Heard this before? We just shipped RBAC + Custom Views to solve exactly this. Granular access control + instant parsers for any log type. blog.runreveal.com/enterprise-rba…

We've been systematically rebuilding our documentation over the past few months. The work isn't flashy, but it directly impacts how fast teams can adopt RunReveal and get value from the platform. 𝐊𝐞𝐲 𝐢𝐦𝐩𝐫𝐨𝐯𝐞𝐦𝐞𝐧𝐭𝐬: 𝐒𝐞𝐚𝐫𝐜𝐡𝐚𝐛𝐥𝐞 𝐬𝐨𝐮𝐫𝐜𝐞𝐬 70+ integrations now instantly searchable at docs.runreveal.com/sources, with automated sync from our codebase to keep docs current. 𝐆𝐥𝐨𝐬𝐬𝐚𝐫𝐲 Filterable reference for terms like signals, detections, enrichments—no more hunting for definitions. 𝐕𝐢𝐬𝐮𝐚𝐥 𝐫𝐞𝐟𝐫𝐞𝐬𝐡 RunReveal branding, clear site hierarchy, enhanced dark mode, and clearer product graphics. 𝐎𝐧𝐛𝐨𝐚𝐫𝐝𝐢𝐧𝐠 𝐠𝐮𝐢𝐝𝐞 Step-by-step walkthrough with SQL examples and architecture diagrams At RunReveal, we believe documentation quality is a proxy for product clarity. If we can't explain something clearly, we haven't built it well enough. These changes reduce friction during evaluation, onboarding, and incident response—the moments that matter most. Check it out: docs.runreveal.com

2025 was a *wild* year for us. First security data platform with MCP. Native AI agent. Pipelines that actually work. Dashboards you don't hate. BYOC and on-prem deployments. 70+ new integrations. Thousands of terabytes under management. A 240% bigger team. 2026: 👀 👀 👀 . blog.runreveal.com/2025-recap-jus…

RunReveal is now available on AWS Marketplace! Security teams looking to modernize their security data infrastructure can now purchase RunReveal using their pre-committed AWS spend, making AI-native log management more accessible. 📰 Learn more about it here: blog.runreveal.com/runreveal-now-…