Agent/Indexer Architecture
Lightweight collection agents forward events to a central indexer. Scales from single-server deployments to distributed multi-site architectures.
Public Alpha • Source Available • On-Premises
SIEMatic
A purpose-built security analytics platform with agent/indexer architecture, interactive event search, and modular alert pipelines. SIEMatic is now in public alpha with a public repository and hosted documentation for teams evaluating on-premises security analytics.
Public
Currently in public alpha
On-Prem
Your data stays yours
McIndi
Official license provider
Platform Capabilities
Enterprise-grade security analytics built for teams that can’t afford gaps in visibility.
Interactive Event Search
Query security events with a familiar pipeline syntax. Drill into incidents, correlate events, and extract answers fast.
Custom Dashboards
Build SOC dashboards tailored to your environment instead of relying on generic templates. Track the metrics that matter to your organization.
Modular Alert Pipeline
Define detection logic as modular pipeline commands. Chain conditions, enrichments, and notifications into repeatable detection workflows.
Full REST API
REST API access to every SIEMatic function. Integrate with your existing SOAR, ticketing, and orchestration tools.
On-Premises Deployment
Runs in your environment, whether that is your data center or your cloud account. No telemetry, no cloud dependency, and no data leaving your perimeter.
Built for Regulated Industries
SIEMatic is designed for environments where data residency, audit trails, and chain-of-custody matter.
Healthcare
HIPAA-sensitive event data stays on-premises. Audit trails cover access events, configuration changes, and security alerts without third-party data exposure.
Financial Services
Track authentication events, API access patterns, and policy violations across your gateway estate. Full retention control for regulatory examination.
High-Security Environments
No cloud connectivity required. Air-gappable deployment for environments where external data flows are controlled or prohibited.
Works Well With
SIEMatic is designed to plug into the rest of your stack.
PKI Workbench
SIEMatic runs TLS end to end, so every agent and the indexer need trusted certificates. PKI Workbench can stand up a private CA and issue them without OpenSSL scripting or commercial CA overhead.
Learn More →MAST
Ingesting DataPower or API gateway security events? MAST manages the appliances producing them, including backups, config promotion, and governed operations across your estate.
Learn More →LogSieve
Need grab-and-go log triage on a single host, before or without shipping to the indexer? LogSieve does the same job entirely offline, in one HTML file.
Learn More →Explore the Public Alpha
SIEMatic is now available as an early-release public alpha. You can review the source on GitHub and use the hosted documentation to evaluate the platform in your own environment.
Need to rely on it in production? The public alpha ships as-is and may change without notice. If you need production stability, guaranteed response times, or an SLA, contact us for a paid support contract.