PRIVATE ALPHA · INVITE-ONLY DESIGN PARTNERS

Cut SIEM costs ~65% without losing a single log

Trevane runs in your AWS account, folds repetitive logs, and keeps every raw log in your own S3.

Invite-only design partner cohort for engineering teams spending $1k–$50k+/mo on Datadog or Splunk · Raw logs never leave your VPC. Only summaries go to your SIEM.

71.1%

Volume reduction on a 2.03M-event public dataset stream (Splunk BOTSv3, 1.41 GB)

100%

Raw telemetry retention in S3 Parquet (no NAT or egress fees for S3 traffic)

< 15 ms

Local DuckDB query latency on public datasets

System Architecture

Trevane deploys as an in-VPC daemon that intercepts telemetry before network egress or ingestion billing.

1. Telemetry Ingress

AWS CloudTrail (Management)

AWS VPC Flow Logs (Network)

Kubernetes stdout / FluentBit

CrowdStrike Falcon FDR

2. In-VPC Data Plane

Pass-First-N Folding: Baseline heartbeats pass through so absence-of-event monitors stay alive. Traffic spikes automatically unroll into raw stream pass-through so standard COUNT(*) alerts fire without monitor rewrites.

Threat Gate: Mutating IAM and defense evasion actions (StopLogging, DeleteTrail, CreateAccessKey) bypass folding completely with 0% collapse.

Local NVMe Read Cache: Recent Parquet partitions are cached on instance NVMe for sub-15ms on-call deep-link investigation.

3. Persistence Sinks

Tier 1: S3 Parquet Lakehouse
100% Raw Retained · No egress fees (VPC gateway endpoint)

Tier 2: Hot SIEM (Datadog/Splunk)
Summary Records + Unrolled Spikes (~65% Cut)

Empirical Benchmarks

Evaluated directly with the compiled Rust kernel (trevane_core) across public security datasets (Splunk BOTSv3, OTRF Mordor, AWS CloudTrail). Measures volume reduction ratios and 100% preservation of security-significant events.

High-Volume Operational Streams (SIEM Ingest & Volume Cut)

Evaluated across sliding 30-second windows. Proves that routine heartbeat, polling, and operational telemetry can be aggregated into summaries while retaining 100% of forensic raw logs in customer-owned S3 Parquet.

Dataset	Telemetry Feed Type	Events	Volume Cut	Byte Cut	Attack Context
BOTSv3 2.03M Full Stream Capture 1.41 GB multi-source capture (S3, SMTP, Code42, RDS)	Multi-Source Feed	2,036,380	71.1%	68.6%	✓ 100% (3,752 / 3,752)
BOTSv3 100k Stream Multi-source operational stream capture	CloudTrail + Sysmon + VPC Flow	100,000	71.9%	66.0%	✓ 100% (254 / 254)
BOTSv3 25k Stream Sample Blended operational feed snapshot	CloudTrail + Sysmon + VPC Flow	25,000	65.3%	63.5%	✓ 100% (60 / 60)
Splunk BOTSv3 Enterprise Suite Multi-tier attack simulation baseline	Blended CloudTrail + Sysmon	4,559	73.0%	67.6%	✓ 100% (61 / 61)
Splunk BOTSv3 Host Execution Host process & heartbeat telemetry	Host Endpoint (Sysmon / EDR)	3,616	79.1%	76.9%	Baseline (0 attacks)
Splunk BOTSv3 AWS CloudTrail High-entropy mutating management APIs	AWS Control Plane API	943	53.9%	59.1%	✓ 100% (61 / 61)

Adversarial Attack Invariants (Every Tested Attack Event Forwarded)

When active intrusion payloads or defense-evasion API calls occur, Trevane automatically bypasses rollup folding. 100% of attack payloads are forwarded uncollapsed so downstream Datadog monitors and Splunk correlation searches fire without alert suppression.

Adversarial Scenario	MITRE ATT&CK Technique	Attack Events	Forwarded to SIEM	Aggregation	Alert Invariant
Stratus Red Team CloudTrail tampering attack	T1562.008 (`StopLogging` / `DeleteTrail`)	3	✓ 3 / 3 (100%)	0.0% Collapsed	Every tested attack event was forwarded
Atomic Red Team IAM privilege escalation backdoor	T1078 (`CreateAccessKey`)	67 75 events total	✓ 67 / 67 (100%) 67 of 67 attack events forwarded (75 in total)	0% of attack events collapsed (1 non-attack event folded)	Every tested attack event was forwarded

Design partner program

We're working with a small number of design partners. The pilot is free for 60 days once Trevane is running on your logs, then discounted pricing for the first year. We start with the audit tool on one log export, then run Trevane next to your existing setup in dev or staging.

Planned pricing: flat annual licenses based on daily log volume, starting at $6,000 a year.