Trevane runs as a single compiled binary inside your AWS environment between your forwarders and analytical platforms. It aggregates repetitive operational noise into summary records, stores 100% of raw forensic logs in customer-owned S3 Parquet, and delivers sub-15ms SQL queries via local DuckDB.
Trevane deploys as an in-VPC daemon that intercepts telemetry before network egress or ingestion billing.
Pass-First-N Folding: Baseline heartbeats pass through so absence-of-event monitors stay alive. Traffic spikes automatically unroll into raw stream pass-through so standard COUNT(*) alerts fire without monitor rewrites.
Sub-50µs Threat Gate: Mutating IAM and defense evasion actions (StopLogging, DeleteTrail, CreateAccessKey) bypass folding completely with 0% collapse.
Local NVMe Read Cache: Recent Parquet partitions are cached on instance NVMe for sub-15ms on-call deep-link investigation.
Measured directly with the compiled Rust kernel (trevane_core) on Apple Silicon and AWS Graviton3 instances across authentic production datasets.
Evaluated across sliding 30-second windows. Proves that routine heartbeat, polling, and operational telemetry can be aggregated into summaries while retaining 100% of forensic raw logs in customer-owned S3 Parquet.
| Dataset | Telemetry Feed Type | Events | Volume Cut | Byte Cut | Attack Context |
|---|---|---|---|---|---|
|
BOTSv3 2.03M Full Stream Capture
1.41 GB multi-source capture (S3, SMTP, Code42, RDS)
|
Multi-Source Production Feed | 2,036,380 | 71.1% | 68.6% | ✓ 100% (3,752 / 3,752) |
|
BOTSv3 100k Production Stream
Multi-source operational stream capture
|
CloudTrail + Sysmon + VPC Flow | 100,000 | 71.9% | 66.0% | ✓ 100% (254 / 254) |
|
BOTSv3 25k Stream Sample
Blended operational feed snapshot
|
CloudTrail + Sysmon + VPC Flow | 25,000 | 65.3% | 63.5% | ✓ 100% (60 / 60) |
|
Splunk BOTSv3 Enterprise Suite
Multi-tier attack simulation baseline
|
Blended CloudTrail + Sysmon | 4,559 | 73.0% | 67.6% | ✓ 100% (61 / 61) |
|
Splunk BOTSv3 Host Execution
Host process & heartbeat telemetry
|
Host Endpoint (Sysmon / EDR) | 3,616 | 79.1% | 76.9% | Baseline (0 attacks) |
|
Splunk BOTSv3 AWS CloudTrail
High-entropy mutating management APIs
|
AWS Control Plane API | 943 | 53.9% | 59.1% | ✓ 100% (61 / 61) |
When active intrusion payloads or defense-evasion API calls occur, Trevane automatically bypasses rollup folding. 100% of attack payloads are forwarded uncollapsed so downstream Datadog monitors and Splunk correlation searches fire without alert suppression.
| Adversarial Scenario | MITRE ATT&CK Technique | Attack Events | Forwarded to SIEM | Aggregation | Alert Invariant |
|---|---|---|---|---|---|
|
Stratus Red Team
CloudTrail tampering attack
|
T1562.008 (StopLogging / DeleteTrail) |
3 | ✓ 3 / 3 (100%) | 0.0% Collapsed | Zero Blind Spots |
|
Atomic Red Team
IAM privilege escalation backdoor
|
T1078 (CreateAccessKey) |
75 | ✓ 67 / 67 (100%) | 1.3% Collapsed | Zero Blind Spots |
Flat annual software licenses based on daily ingested volume. Zero per-seat surcharges or analytical query fees.