Axoflow has launched AxoDetect, a detection component now in early access that runs security rules directly in the data pipeline. Announced during Splunk .conf26, AxoDetect applies Sigma rules in stream to clean, normalized security data before it reaches the SIEM, changing how organizations approach detection and log storage.
Detection before the SIEM ingest meter
AxoDetect is designed for detection engineers who need existing detections to fire earlier on cleaner data without paying SIEM ingestion rates for raw log volume. The platform runs customer rules in the pipeline, sends alerts to the SIEM, and stores full-fidelity logs in AxoLake, Axoflow’s low-cost security data lake that can also run on-premises.
The result makes the SIEM effectively optional as a log management system. Instead, the SIEM becomes a SecOps workflow engine for alerts and investigations, not a repository for an entire data estate.
Sigma rules in one open format
Detection engineers can write new Sigma rules, tune existing ones, and import community rules in one open format that works across tools. AxoDetect adds visibility that has historically been fragmented: what data is coming in, which detection each source feeds, and where a rule lacks the data it needs. That reduces the back-and-forth between detection and data teams that has typically been held together with manual processes and tool-switching.
Customer results
- A global industrial company cut SIEM costs by 50% and reduced mean time to resolution by 85%.
- A government agency reduced data volume by 80% and infrastructure footprint by 85%.
“The SIEM became the industry’s most expensive data swamp because it was the place where we kept all of our raw data,” said Balázs Scheidler, CEO and co-founder of Axoflow and creator of syslog-ng. “That constraint is gone. Detection belongs in the data layer, on normalized data, before the ingest meter starts. Keep your workflow in the SIEM. Send the alerts, but not your entire data estate.”
What’s next
Axoflow says the full detection lifecycle will run where the data lives, with additional capabilities rolling out in the months ahead.
About Axoflow
Axoflow describes itself as an autonomous security data layer for collecting, processing, routing, storing, and managing data, with in-stream detection now in early access. The company says its AI-based autonomy supports 10x faster investigations, 50% lower SIEM spend, and near-zero pipeline maintenance. Axoflow was founded by the creators of syslog-ng.