Abstract Security

What is Abstract Security?

Abstract Security is a composable SIEM (security information and event management) platform that splits a monolithic security stack into modular parts for collection, detection, retention and AI-assisted operations.

Key capabilities of Abstract Security

• Security data fabric: Normalizes, enriches, filters and routes data from cloud, SaaS, network, endpoint and identity sources.
• Multi-model detection: In-stream, historical and distributed detections for real-time and retroactive analysis.
• Tiered retention: Real Time, Hot and Warm storage tiers match data value to storage cost.
• AI-enabled SecOps: AI-assisted triage, context-rich investigations and threat hunting in one analyst workbench.

How Abstract Security works

Logs from cloud, SaaS, network, endpoint and identity systems enter the data fabric, where they are normalized, enriched, filtered and routed by analytical intent instead of being indexed identically. Detections run in-stream or against stored data. Analysts then triage and investigate in a unified workbench with AI assistance. The vendor shows one example VPC Flow pipeline cutting 280GB of input to 66GB, about 35% less storage volume.

Who uses Abstract Security?

Security operations teams that want to lower SIEM ingestion cost or add detection in front of an existing SIEM. Named customers include OneMain Financial, Juul Labs, Altana and OmegaBlack. The company announced $25M in growth funding.

Abstract Security pricing

The vendor does not publish prices. Access starts with a demo request, and no free tier or trial is listed on the site.

Abstract Security alternatives

Abstract Security is often compared with Cribl, which focuses on data pipelines, and with full SIEM suites such as Splunk and Microsoft Sentinel, which it can also feed.