A security data stack, batteries included
Runs on the data in your cloud
Management plane
The management plane is hosted by Perpetual. It provides the web interface, API, and MCP access. All configuration, detection logic, case management, and user state lives here. It does not store or process your security event data.
Data plane
Ingestion, parsing, normalization, query execution, and storage management all run in the data plane, backed by cloud object storage in your account. Event data goes into Apache Iceberg tables in Parquet format.
Not bolted onto anything,
no need for $cloud_data_warehouse
Data never crosses your compliance boundary. It never leaves your cloud account.
Any tool that reads Iceberg and Parquet can query it, not just Perpetual. You are never locked in.
One storage tier, no forced split between cold archive and hot query tier. Cheap enough to keep everything, fast enough to query anything.
Security data, engineered
Security analytics is a data engineering problem. Perpetual treats parsing, normalization, enrichment, and correlation as stages in a processing workflow. Simba sees that entire workflow as context: lineage, transformations, schemas, and documentation.
Start with a question, not with a table name
The catalog tracks every dataset, field, and transformation. Simba uses it to connect the terms analysts use in their questions to the data model and to build the right query.
Let me check what authentication-related datasets are available.
Based on my search across your datasets, here's a summary of the authentication event sources currently available:
Summary
| Source | Dataset(s) | Auth Event Types |
|---|---|---|
| Okta (IdP/SSO) | okta_events | Logins, MFA, SSO, session events |
| AWS CloudTrail | cloudtrail_events | Console logins, IAM auth |
| Windows Security | sysmon_events | Logon/logoff, Kerberos, NTLM |
The pieces fit, and you can see how
Perpetual models the entire data pipeline as a dependency graph. Detections depend on normalized data, normalization depends on parsed data, and parsing depends on ingested raw data. Detections can even depend on other detections for scenario detections!
Scenario - Windows ClickFix Initial Access
Query DetectionClickFix C2 Activity Detection - Initial Access and Command & Control
Detection Overview
This detection identifies ClickFix malware campaigns that abuse Windows Run Dialog functionality to execute malicious PowerShell commands followed by command-and-control (C2) communications. It correlates three behavioral indicators within seconds: suspicious process creation, Windows Run Dialog registry activity, and network beaconing to known C2 infrastructure (185.91.69.119).
Detection Logic
Data Sources Monitored
One query language for everything
Hamelin is a single language for every security operation: parsing, detection, hunting, and investigation. No context switching, no separate syntax to learn.
Security operations spans four activities: parsing, detection, hunting, and investigation. Hamelin is a single language that covers all of them. On many platforms, at least one of these requires a different language, with its own syntax and learning curve. In Perpetual, Hamelin is all you need.
Hamelin queries are readable by design. You can read and understand a query even if you didn't write it and even if you're not an expert in the language. This matters because in Perpetual, most queries are written by Simba.
When Simba investigates a question, you can read its queries to understand its reasoning. When Simba builds a detection, you can read the proposed query to understand exactly how it plans to detect the threat. Review it, discuss it with Simba, change it if you like, and deploy it. If you get stuck writing a query yourself, just ask Simba to finish it for you.
Here’s the signal count by hour over the last 7 days:
Parsing
Hamelin can parse any log format into structured fields. It is especially good at parsing JSON. Access the fields in parsed JSON values using the fluent field lookup syntax you'd expect. Hamelin is also good at anchor-parsing printf-style logs. Just use the `PARSE` command. You won't need to reach for regex to do most parsing.
Everything as code
Hamelin is a single language for every security operation: parsing, detection, hunting, and investigation. No context switching, no separate syntax to learn.
