Discern: log anomaly and intrusion detection
Nobody reads the logs. Discern does.
Discern reads your logs as they are written and learns what a normal day looks like on each one. When something changes, such as a login pattern never seen before, a process doing something new or an error storm building, it raises an alert with the log lines that caused it. No rules to write and no query language to learn.
The detection behind Discern scores an AUC of 0.9246 on ADFA-LD, a public dataset of Linux intrusions from UNSW, deciding within the first ten system calls of a process. The full run is on the benchmarking page, and you can re-run it yourself.
The problem
Rules only catch the attacks you already thought of.
Most log security means writing detection rules, tuning them when they misfire and hoping the next intrusion looks like one of them. New attacks, and the quiet ones, slip through, and the alerts that do fire are buried in noise.
Discern does not match a list of known attacks. It notices when your logs stop looking like your systems on a normal day, and shows you exactly which lines changed. Point it at syslog, auth logs, application logs, a journald unit or a web server access log.
How it works
Read the logs. Learn their shape. Flag what changed.
Step one
It reads logs where they are
Tail a file, receive syslog, read a journald unit or take a shipped stream. Everything happens on your own servers, and your logs never leave them.
Step two
It learns what normal looks like
Discern learns each log's usual messages, which ones appear together, the sequences that repeat and the rates that are normal for this hour on this host. No labelled incidents and no signature feed.
Step three
It shows you the evidence
When a log stops matching its normal, Discern raises an alert with the actual lines that changed and what was unusual about them. Your analyst starts from the evidence, not a search box.
What you get
The lines that caused the alert, not a pointer to a dashboard.
A sample finding, so you can see the shape of what Discern reports.
Departure in a log stream
Needs review- Source
- auth.log on app-prod-03
- Raised
- 2026-09-21 02:41:12 AEST
- Window
- 02:38:00 - 02:41:00
- Character
- Unseen pattern structure not present in learned normal
The lines that departed
Sep 21 02:38:44 app-prod-03 sshd[24188]: Accepted publickey for deploy from 198.51.100.22
Sep 21 02:39:01 app-prod-03 sudo: deploy : TTY=unknown ; PWD=/ ; USER=root ;
COMMAND=/usr/bin/find / -name id_rsa
Sep 21 02:39:55 app-prod-03 sudo: deploy : TTY=unknown ; PWD=/ ; USER=root ;
COMMAND=/usr/bin/tar -czf /tmp/.cache.tgz /etc /home
Sep 21 02:40:40 app-prod-03 sshd[24188]: Disconnected from user deploy 198.51.100.22
Why it was raised
The deploy account has authenticated on this host before, at this hour, from this network. None of that is unusual on its own. What has never happened here is this account following a login with a filesystem-wide secret search and an archive of configuration and home directories, then disconnecting. The sequence, not any single line, is the departure.
No rule was written for this. Nothing in it matches a known signature.
Sample finding. The hosts, addresses and log lines are examples.
No rules to author
No detection content to buy, subscribe to, or keep current. No query language between you and your own logs.
Logs never leave
Analysis happens on the box holding the logs. For anything covered by residency or classification rules, that is the difference between usable and not.
Findings you can hand over
Each finding carries its evidence and its reasoning, so it can go straight into an incident record or to a security operations centre without a translation step.
Pricing
Flat per month, with the volume stated up front.
Flat and never metered, with a 3-day grace period after expiry before the instance goes read-only. Your data is never deleted on lapse.
- 50 GB of logs per month
- 25 log sources
- 30-day retention
- 10 activated instances
- Annual is AUD $1,990
- Discern, Shield, Pulse, Vitals
- 250 GB of logs per month
- One console, one subscription
- Cheaper than the $2,396 sum
- Every product, unlimited caps
- Offline licence activation
- No call-home for verification
- Large fleets: Contact us
Prices, meters and grace period are read from one price file. All amounts include 10% GST. Subscriptions are arranged with our team directly, on your own hardware, with a guided setup.
Point it at one log source.
Tell us which log sources matter, and we will show you how Discern learns the causal structure of a normal day on each one, on your own hardware.