Skip to content

What is Logster

Logster is an AI-driven endpoint threat detection platform. It ingests security logs from Windows and Linux endpoints, analyzes them with a pre-trained AI detection model, and surfaces MITRE ATT&CK and zero-day attacks in real time — without requiring manual threat hunting or hand-authored correlation rules. This documentation describes the key features, installation, and administration, and explains how it can help SOC Analysts and Threat Hunters streamline their complex security operations.

The problem Logster solves

Conventional rule-based SIEMs are struggling against the modern threat landscape:

  • Adaptive, AI-powered attacks change tactics faster than detection engineers can author new rules.
  • Polymorphic malware mutates to obfuscate itself, breaking signature detection entirely.
  • Rule-based SIEM detection is cumbersome — every new technique demands a new rule, and rules decay as environments evolve.
  • SIEMs lack holistic, context-aware analysis — they evaluate events in isolation rather than understanding behaviors across time and across the relationships between processes, files, and network activity.

Logster takes a different approach: it analyzes an endpoint's activity as a stream of behaviors and classifies sliding windows of that activity with a pre-trained detection model. The model sees the shape of activity, not individual events — which is what lets it recognize attack patterns it has never seen the exact binary for.

How Logster works

Logster's security data pipeline is comprised of five discrete stages, as explained below:

  1. Collection — In the collection stage, all security events are collected from enterprise endpoints in real time and forwarded to a centralized Logster deployment. Logster currently supports detections based on Microsoft Sysmon events and PowerShell script logs on all Windows-based endpoints, and supports auditd and eBPF events on Linux-based endpoints. These events can be ingested into Logster's Kafka engine by utilizing any endpoint agents (like Winlogbeat on Windows, or rsyslog on Linux). Please consult Logster customer services for any customized data collection and forwarding requirements.
  2. Normalization — A stateless normalizer service transforms raw events from each source into a unified NormalizedEvent schema.
  3. Inference — All security events are buffered into per-endpoint sliding windows (30 seconds) in order to discover attacker techniques. Every 30 seconds, Logster runs the detection model over each window of process, file, network, and other security events to classify it as benign or attack.
  4. Alerting — In this stage, attack predictions are triggered as alerts and deduplicated across a 5-minute window to suppress similar alerts, and also correlated for lateral movement across a 60-second window. All alerts are also enriched with MITRE ATT&CK technique IDs for better understanding of attacker behaviour, and published as structured alerts to the next stage.
  5. Presentation — A comprehensive centralized console that exposes alerts, inference results, host summaries, process trees, and analyst feedback endpoints.

Who Logster is for

Logster is built for security operations center (SOC) teams and the operators that support them:

  • SOC Analysts who need to triage detections, walk process trees, and record true/false-positive verdicts without stitching together multiple different security solutions (including SIEM, EDR, XDR, SOAR). See the User Guide.
  • Detection Engineers who want AI-driven ML detections alongside (or replacing) their existing rule-based SIEM pipeline.
  • Platform / Support Teams responsible for standing up, configuring, and keeping Logster healthy at enterprise scale. See the Admin Guide.
  • Security Architects evaluating whether Logster fits their data residency, compliance, and detection requirements. See the Licensing Guide for deployment options.

What Logster detects

Logster is designed to surface malicious activities across the following MITRE ATT&CK Tactics:

  • Reconnaissance
  • Resource Development
  • Initial Access
  • Execution
  • Persistence
  • Privilege Escalation
  • Defense Evasion
  • Credential Access
  • Lateral Movement
  • Command & Control
  • Impact
  • Exfiltration

Each detected alert carries one or more MITRE technique IDs in its ttp_techniques field. See the User Guide for better understanding of TTP reporting in the Logster console.

Supported platforms

Logster currently supports endpoint collection on:

  • Microsoft Windows — supports all Server and Desktop versions, using Sysmon and PowerShell script logging shipped through any log forwarding agent including Winlogbeat, Fluentd, NXLog, OpenTelemetry, Wazuh, Splunk Forwarder, or Windows Subscription Logging.
  • Linux — supports all major distributions (including Red Hat, Ubuntu, and others), via the auditd daemon and eBPF process/file/network collectors, shipped through rsyslog, Splunk Forwarder, syslog-ng, or any other log forwarding agent.

For the full matrix of supported ingestion agents, see Key Features.

What Logster is not

To set expectations clearly:

  • Logster is not a SIEM. It does not replace your log retention or compliance reporting. Logster focuses narrowly on real-time threat detection and analyst triage. It can live alongside an existing SIEM.
  • Logster does not ship rules. There is no rule pack to tune. Detection is driven entirely by pre-trained models that Logster Support ships and updates.
  • Logster is not an EDR. It does not execute response actions on endpoints (kill process, quarantine host, block IP). It surfaces detections; response is your SOAR's job.
  • Logster does not do network inspection. It utilizes only endpoint telemetry data, and does not rely on actual packet captures.