logrok

Free plan APILinuxMacSelf-hostedWebWindows

What logrok is

Logrok is a self-hosted platform for log management and threat detection, designed to run within a customer’s environment. It collects data from syslog, webhooks, cloud APIs, and files; the product page says one node can handle 200K+ events per second. Search options include plain text, regex, Lucene query syntax, and natural-language AI queries. Detection features include 25+ built-in rules mapped to MITRE ATT&CK, correlation logic, and a custom rule DSL. Log pipelines, archive export, and live log tailing are supported, with 20+ listed destinations such as S3, Kafka, Splunk, Elasticsearch, Azure, GCP, Loki, and Datadog. AI tools include noise filtering, anomaly detection, an investigation assistant, and an MCP server. The platform says it has no telemetry or call-home and can operate offline in air-gapped deployments. LUnA, its static agent, runs on Windows, Linux, and macOS. The Community tier is free for a single-host Docker Compose trial kit; pricing is otherwise on request.

Who it suits

Logrok is aimed at defense and intelligence, critical infrastructure and ICS-SCADA, government and NATO, and enterprise SOC or MSSP teams. Its self-hosted and offline deployment options may suit teams that need to run log management inside their own environment.

What it does well

Collects logs from syslog, webhooks, cloud APIs, and files
Supports plain text, regex, Lucene, and AI search
Lists 25+ MITRE ATT&CK-mapped detection rules
Offers 20+ data destinations
LUnA supports Windows, Linux, and macOS

What to know first

Pricing is available on request
Free tier is a single-host Docker Compose trial kit

Limits

The free Community tier is a single-host Docker Compose trial kit. Logrok’s paid pricing is available on request.

Plans

Plan	Billed and limits	Price
Community tier	Free single-host Docker Compose trial kit	Free

As logrok.com lists them, read 12 Oct 2026. The maker's own page has the final word.

Getting started

Open https://logrok.com/
Request or use the Community tier single-host Docker Compose trial kit
Deploy Logrok in your environment
Ingest logs from syslog, webhooks, cloud APIs, or files
Configure searches, detection rules, and destinations
Deploy the LUnA agent on Windows, Linux, or macOS when needed

Verdict

Logrok combines log collection, search, detection, and export with self-hosted deployment. Its offline operation and listed security controls are relevant for organizations that need to keep the platform within their environment.

Questions

What is Logrok’s free option?

The Community tier costs nothing and provides a single-host Docker Compose trial kit.

Where can Logrok run?

It is self-hosted and lists API, Linux, macOS, Windows, web, and self-hosted platforms. The platform also describes fully offline and air-gapped operation.

What log sources does Logrok accept?

It ingests syslog, webhooks, cloud APIs, and files. LUnA also lists inputs such as Windows Event Log, journald, Modbus, and SNMP traps.

Which destinations are supported?

Listed destinations include S3, Kafka, Splunk, Elasticsearch, Azure, GCP, Loki, and Datadog, among more than 20 options.

What detection features are included?

Logrok lists 25+ built-in rules with MITRE ATT&CK mapping, correlation logic, a custom rule DSL, anomaly detection, and other AI features.

Who does Logrok target?

Its solutions page names defense and intelligence, critical infrastructure or ICS-SCADA, government or NATO, and enterprise SOC or MSSP teams.

Facts from logrok's own pages

Agent integrations: LUnA lists inputs such as Windows Event Log, journald, Modbus, and SNMP traps, and outputs including syslog, Kafka, Loki, S3, Sentinel, and Splunk HEC. · logrok.com, 12 Oct 2026
Agent platforms: LUnA is a static agent binary for Windows, Linux, and macOS. · logrok.com, 12 Oct 2026
AI features: Its AI features include noise filtering, an investigation assistant, natural-language search, anomaly detection, and an MCP server. · logrok.com, 12 Oct 2026
Archive export: Yes · logrok.com, 22 Sept 2026
Collection: It ingests logs from syslog, webhooks, cloud APIs, and files, and the page states a single node handles 200K+ events per second. · logrok.com, 12 Oct 2026
Compliance: The maker lists FIPS 140-3, DISA STIG, CIS Level 1, NIST SP 800-53 alignment, CMMC Level 2 support, and OCSF v1.3. · logrok.com, 12 Oct 2026
Deployment: The platform describes itself as self-hosted, with no telemetry or call-home, and says it runs fully offline in air-gapped deployments. · logrok.com, 12 Oct 2026
Destinations: Logrok lists 20+ destinations, including S3, Kafka, Splunk, Elasticsearch, Azure, GCP, Loki, and Datadog. · logrok.com, 12 Oct 2026
Detection: The platform page lists 25+ built-in detection rules with MITRE ATT&CK mapping, correlation logic, and a custom rule DSL. · logrok.com, 12 Oct 2026
Intended users: The solutions page names defense and intelligence, critical infrastructure/ICS-SCADA, government/NATO, and enterprise SOC/MSSP teams. · logrok.com, 12 Oct 2026
Live log tailing: Yes · logrok.com, 22 Sept 2026
Log pipelines: Yes · logrok.com, 22 Sept 2026
Product: Logrok is a self-hosted log management and threat detection platform that runs inside the customer’s environment. · logrok.com, 12 Oct 2026
Search: Search supports plain text, regex, Lucene query syntax, and natural-language AI queries. · logrok.com, 12 Oct 2026
Security: The trust page states AES-256-GCM encryption at rest with per-tenant keys, FIDO2/YubiKey/Passkey/CAC/PIV authentication, append-only audit logs, and role-based access control. · logrok.com, 12 Oct 2026
Structured log parsing: Yes · logrok.com, 22 Sept 2026
Support: The maker offers guided demos and says users can email its security contact to report vulnerabilities for a prompt response. · logrok.com, 12 Oct 2026

Where logrok stands on Freedom251

Log Management Software#24 of 111