A security operations platform with 12 enterprise modules, multi-SIEM federation across 8+ platforms, 6 query languages, a fully featured Standalone Native backend, and 7 deployment options: bare metal, Docker, Kubernetes, cloud VMs, virtualised environments, air-gapped networks, or SinonTech-hosted. You own 100% of your data regardless of where Umbra runs. We never access, mine, or sell it.
Risk scoring, deception fabric, ITDR, BAS, insider threat, attack path analysis, encrypted traffic intelligence, supply chain monitoring, dark web monitoring, network forensics, OT/ICS/SCADA, and DFIR. All included.
Dashboards, investigation timelines, war rooms, case boards, hunting workbenches, compliance reports, and executive summaries. Designed for analysts, not admins.
Write detection rules and ad-hoc queries in KQL, SPL, Lucene, SQL, EQL, or Elasticsearch DSL. Bring your team's existing expertise. No retraining required.
Bare metal, Docker Compose, Kubernetes with Helm, cloud VMs (AWS EC2, Azure VM, GCP Compute), virtualised environments (VMware, Hyper-V, Proxmox), or fully air-gapped offline installation. Every mode ships with TLS, health checks, and automated backups.
Federate queries and ingest alerts from Splunk, IBM QRadar, Google Chronicle, Microsoft Sentinel, Wazuh, SentinelOne, Palo Alto XSIAM, and Microsoft Defender. One search across every SIEM your organisation operates.
Every module listed below is included in the platform. There are no paid tiers, no feature gates, and no usage caps. Enable or disable modules per tenant, per team, or per user through the built-in feature toggle system.
ML-driven risk scoring that prioritises alerts by actual business impact, asset criticality, and threat intelligence context. Analysts see what matters first. Organisations that deploy risk-based scoring consistently report an 80% reduction in alert fatigue, not because alerts disappear, but because triage becomes deterministic rather than gut-driven.
Deploy honeypots and canary tokens across your network to detect lateral movement the moment it happens. Deception-based detections carry a zero false-positive rate by definition: no legitimate user or process should ever interact with a decoy asset. Umbra manages the full lifecycle: deployment, rotation, alerting, and forensic capture.
Continuous monitoring of authentication events, session behaviour, and privilege usage across your identity providers. Detect impossible travel, credential stuffing, privilege escalation, dormant account abuse, and OAuth consent phishing. ITDR extends the existing UEBA engine with identity-specific behavioural baselines and risk indicators.
Automated attack simulations mapped to the full MITRE ATT&CK framework. Schedule simulation campaigns against your own environment, measure detection coverage, identify blind spots, and track improvement over time. Every simulation produces a gap analysis report with specific detection rule recommendations.
Native protocol parsing for Modbus, DNP3, OPC-UA, BACnet, and IEC 61850. Umbra understands industrial control system traffic at the application layer, not just port and byte counts. Detect firmware uploads, configuration changes, unauthorised commands, and process variable anomalies without deploying agents on controllers.
Intelligent packet capture that records full sessions for flagged traffic and metadata-only for everything else. Extract IOCs, reconstruct TCP sessions, decode application-layer protocols, and correlate network evidence with endpoint telemetry. Smart PCAP reduces storage requirements by up to 90% compared to full-take capture while preserving forensic completeness for investigated incidents.
Federate queries across Splunk, QRadar, Google Chronicle, Microsoft Sentinel, Wazuh, and more, from a single search bar. Umbra translates your query into each platform's native language, executes in parallel, normalises the results, and presents a unified timeline. For organisations running multiple SIEMs across business units, acquisitions, or regional deployments, federation eliminates the "swivel-chair" problem without requiring data migration.
Natural-language investigation powered by a local LLM integration: ask questions like "Show me all failed logins from Eastern Europe in the last 24 hours" and get structured queries in return. The SOAR engine provides automated playbooks, orchestration workflows, war rooms for collaborative incident response, and full case management with evidence chains and SLA tracking.
Data flows through three distinct layers. Each layer operates independently, scales horizontally, and can be deployed across separate hosts or collapsed onto a single machine in standalone mode.
Umbra ingests security telemetry from any source: syslog (RFC 3164/5424), Beats agents, HTTP/JSON webhooks, Kafka topics, S3 buckets, Windows Event Forwarding, cloud audit logs (AWS CloudTrail, Azure Activity, GCP Audit), and native SIEM federation connectors.
Normalisation happens at ingest time. Every event is parsed, enriched with threat intelligence and asset context, mapped to a common schema, and written to the storage engine. The ingestion pipeline supports back-pressure, dead-letter queues, and per-source rate limiting.
Supported throughput: 50,000+ events per second on a single node; horizontally scalable with Kafka-backed partitioning.
Events pass through a multi-stage detection pipeline:
Detection rules support all six query languages. Write in whichever language your team already knows.
When an alert fires, Umbra can:
Every action taken (automated or manual) is recorded in an immutable audit log.
Umbra ships with a complete alternative backend that delivers full feature parity with the primary deployment, without requiring PostgreSQL, Redis, Elasticsearch, or Celery. The Standalone Native backend uses SQLite for storage and a built-in file-based inverted index for full-text search, providing every feature of the main platform on a single machine.
This is not a "lite" edition. Standalone Native includes all 94 API route modules, all 1,675 endpoints, all 12 enterprise modules, and all detection/response capabilities. It runs the same frontend, supports the same query languages, and processes the same telemetry. The difference is purely infrastructural: zero external services required.
Under the hood, 12 purpose-built performance optimisations (zone maps, bloom filters, adaptive caching, columnar storage, delta encoding, roaring bitmaps, FST indexing, parallel scanning, vectorised aggregations, tiered merge compaction, write coalescing, and a cost-based query optimiser) allow SQLite to handle production-grade workloads that would ordinarily require a distributed database cluster.
Starts in under 3 seconds on any Linux host with Python 3.10+. Purpose-built for air-gapped networks, edge deployments, rapid incident response, lab testing, and small-team SOCs that need enterprise-grade capability without enterprise-grade infrastructure.
Umbra is not a product you adapt your operations around. It is a platform you adapt to your operations.
Every organisation runs security differently. Threat models vary. Compliance requirements vary. Team structures, shift patterns, escalation chains, and tooling preferences vary. A SIEM that imposes a single workflow on every customer is a SIEM that gets worked around rather than worked with.
Umbra is designed from the ground up to be fully customisable at every layer:
Your SIEM should work the way your team works. Not the other way around.
Every deployment mode ships with automated installation scripts, TLS configuration, health monitoring, backup scheduling, and a comprehensive ctl management utility. Choose the mode that fits your infrastructure. Migrate between modes at any time.
Full control. No abstraction layers.
A single install.sh script provisions PostgreSQL, Redis, Elasticsearch, Nginx with TLS termination, and systemd service units for all 18 platform services. The installer detects your distribution (Debian, Ubuntu, RHEL, Rocky, Alma), installs dependencies from official repositories, configures firewall rules, and sets up log rotation.
Uninstallation is equally thorough: --uninstall stops services and removes binaries; --purge-data clears databases; --purge-all leaves no trace.
Best for: Dedicated security appliances, compliance-sensitive environments, organisations that require full OS-level control.
Production-ready in minutes.
Three Docker Compose profiles ship out of the box: development, production, and high-availability. The production profile includes 12 enterprise worker containers, persistent volumes, health checks with automatic restart, resource limits, and a pre-configured Nginx reverse proxy.
All configuration is driven by a single .env.production file. Upgrade by pulling new images and running docker compose up -d.
Best for: Teams already running Docker infrastructure, rapid deployment, staging and testing environments, MSPs deploying per-client instances.
Your cloud. Your SIEM. Their compute.
Deploy Umbra on any cloud provider's virtual machines: AWS EC2, Azure VMs, GCP Compute Engine, or any IaaS offering. Use your existing cloud infrastructure without surrendering data to a vendor-managed SaaS. You control the instance, the network, the storage, and the encryption keys.
Combine with Kubernetes on EKS, AKS, or GKE for auto-scaling. All installation scripts work identically whether the underlying host is physical or cloud-provisioned.
Best for: Organisations with existing cloud infrastructure who want self-hosted control without on-premise hardware.
Run on the hypervisor you already operate.
Full support for VMware ESXi/vSphere, Microsoft Hyper-V, Proxmox VE, KVM/QEMU, and Xen. Deploy Umbra as a virtual machine alongside your existing virtualised infrastructure. Snapshot, clone, and template your SIEM deployment using standard hypervisor tooling.
OVA/OVF appliance images are available for VMware environments. All supported Linux distributions run identically under any hypervisor. There are no hardware-specific dependencies.
Best for: Organisations running virtualised data centres, lab environments, and hybrid infrastructure spanning physical and virtual hosts.
Horizontal scaling. Rolling updates. Self-healing.
The Helm chart includes 17+ Kubernetes templates with Bitnami subcharts for PostgreSQL, Redis, and Elasticsearch. Horizontal pod autoscaling, pod disruption budgets, network policies, service accounts with least-privilege RBAC, and Ingress with cert-manager TLS are all configured by default.
Values files are structured for easy per-environment overrides. Deploy to EKS, AKS, GKE, or on-premise clusters with identical configuration.
Best for: Large-scale deployments, organisations with existing Kubernetes operations teams, multi-region high availability.
Zero internet. Zero exceptions.
The package-airgap-bundle.sh script builds a self-contained tarball with every dependency: Python wheels, Node.js binaries, PostgreSQL packages, Redis, Elasticsearch, Nginx, and system libraries. Transfer the bundle to the target host via USB, DVD, or secure file transfer.
The install-airgap.sh script unpacks and installs everything from the local bundle: no package manager calls, no DNS lookups, no outbound connections. Phase tracking allows interrupted installations to resume from where they left off.
Best for: Classified networks, SCIF environments, defence contractors, critical infrastructure operators, any deployment where outbound internet access is prohibited.
Security telemetry is not ordinary data. It contains authentication patterns, network topology, vulnerability scan results, incident response procedures, and the behavioural fingerprints of every user and system in your organisation. It is, in aggregate, the most sensitive data you produce.
With most SIEMs, you surrender this data to a vendor's cloud, placing your entire security posture on infrastructure you do not own, accessible to a company whose practices you must take on trust. With Umbra, you own your data regardless of deployment. Self-host it on your infrastructure, or let us host it. Either way, we never access, read, or mine your security telemetry.
Your data ownership is absolute. Export everything at any time. Delete on your terms. No exceptions.
NIS2, DORA, SOC 2 Type II, ISO 27001, GDPR, HIPAA, and sector-specific regulations increasingly mandate data residency, processing locality, and demonstrable control over security tooling. Cloud-hosted SIEMs require extensive due diligence, data processing agreements, sub-processor audits, and ongoing compliance monitoring just to satisfy the requirements your SIEM is supposed to help you meet.
Umbra satisfies these requirements by design. Deploy on your own infrastructure for full perimeter control, or use our hosted service where we manage the servers but never access your data. Audit trails are under your control. There is no sub-processor chain to audit.
You own the data. You define the retention. You control the access. That is compliance simplified.
When your cloud SIEM vendor experiences an outage (and they will), your SOC goes dark at the exact moment you need it most. You cannot search logs, you cannot triage alerts, you cannot run playbooks, and you cannot investigate incidents. Your security operations become entirely dependent on a third party's uptime.
Umbra eliminates this dependency. Whether self-hosted or SinonTech-hosted, your data is always yours to export, migrate, or move. No egress fees, no export delays, no ransom disguised as a migration project. If you decide to leave, you take everything with you.
For smaller teams, the Standalone Native backend makes this even more accessible: a complete SIEM running on a single machine with SQLite, no external services required. Full feature parity whether you are a 5-person security team or a 500-person SOC.
Operational continuity and data ownership are security requirements. Umbra guarantees both.
Full tenant isolation with per-tenant databases, per-tenant feature toggles, sub-tenant hierarchies, and tenant-scoped RBAC. Built for MSPs managing dozens of client environments from a single deployment.
Automated scanning of dark web marketplaces, paste sites, and forums for leaked credentials, exposed data, and threat actor chatter referencing your organisation's domains, IPs, and brand names.
Track third-party software dependencies, vendor security posture, and software bill of materials (SBOM) data. Receive alerts when a vendor in your supply chain discloses a breach or a dependency publishes a critical CVE.
Graph-based modelling of potential attack paths through your infrastructure. Identify choke points, calculate blast radius, and prioritise remediation based on which assets an attacker could reach from a given foothold.
Behavioural analytics focused on insider risk indicators: unusual data access patterns, off-hours activity, mass downloads, privilege abuse, and resignation-correlated behaviour changes. Integrated with ITDR and UEBA for contextual risk scoring.
Analyse encrypted traffic without decryption using JA3/JA3S fingerprinting, certificate analysis, entropy scoring, and connection behaviour profiling. Detect C2 channels, data exfiltration, and malicious TLS tunnels without breaking end-to-end encryption.
| Backend | Python 3.10+ / FastAPI / SQLAlchemy / Celery / aiohttp |
|---|---|
| Frontend | React 18 / TypeScript / Vite / Tailwind CSS / Zustand |
| Primary Storage | PostgreSQL 14+ (multi-tenant) / SQLite (standalone) |
| Search Engine | Elasticsearch 8.x (primary) / Built-in inverted index (standalone) |
| Cache / Broker | Redis 7+ (primary) / In-memory scheduler (standalone) |
| Task Queue | Celery with Redis broker (primary) / asyncio scheduler (standalone) |
| Web Server | Nginx with TLS termination, rate limiting, and WebSocket proxying |
| Authentication | Local accounts, LDAP/AD, SAML 2.0, OAuth 2.0/OIDC, API keys, MFA (TOTP) |
| Query Languages | KQL, SPL, Lucene, SQL, Sigma, Elasticsearch DSL |
| API | RESTful + GraphQL / 1,600+ endpoints / OpenAPI 3.0 documentation |
| Minimum Hardware | 4 vCPU, 8 GB RAM, 100 GB storage (standalone) / 8 vCPU, 32 GB RAM, 500 GB (full deployment) |
| Supported OS | Ubuntu 20.04+, Debian 11+, RHEL 8+, Rocky 8+, AlmaLinux 8+ |
| Container Runtime | Docker 20.10+ / Podman 4+ |
| Orchestration | Kubernetes 1.24+ / Helm 3.10+ |
| Licence | Commercial (per-instance, not per-GB) |
Be among the first to deploy a SIEM that actually belongs to you.
Umbra is currently in closed beta. Register below to request access, architecture documentation, and deployment guides before general availability. No credit card. No cloud account. Just your infrastructure.
Get in touch to discuss your requirements.