Trevane runs in your AWS account, folds repetitive logs, and keeps every raw log in your own S3.
Trevane deploys as an in-VPC daemon that intercepts telemetry before network egress or ingestion billing.
Pass-First-N Folding: Baseline heartbeats pass through so absence-of-event monitors stay alive. Traffic spikes automatically unroll into raw stream pass-through so standard COUNT(*) alerts fire without monitor rewrites.
Threat Gate: Sensitive CloudTrail management API calls (StopLogging, DeleteTrail) and mutating IAM actions (CreateAccessKey, PutUserPolicy) bypass folding completely with 0% collapse.
Local NVMe Read Cache: Recent Parquet partitions are cached on instance NVMe for sub-15ms on-call deep-link investigation.
Evaluated directly with the compiled Rust kernel (trevane_core) across public security datasets (Splunk BOTSv3, OTRF Mordor, AWS CloudTrail). Measures volume reduction ratios and 100% preservation of security-significant events.
Evaluated across sliding 30-second windows. Proves that routine heartbeat, polling, and operational telemetry can be aggregated into summaries while retaining 100% of forensic raw logs in customer-owned S3 Parquet.
| Dataset | Telemetry Feed Type | Events | Volume Cut | Byte Cut | Attack Context |
|---|---|---|---|---|---|
|
BOTSv3 2.03M Full Stream Capture
1.41 GB multi-source capture (S3, SMTP, Code42, RDS)
|
Multi-Source Feed | 2,036,380 | 71.1% | 68.6% | ✓ 100% (3,752 / 3,752) |
|
BOTSv3 100k Stream
Multi-source operational stream capture
|
CloudTrail + Sysmon + VPC Flow | 100,000 | 71.9% | 66.0% | ✓ 100% (254 / 254) |
|
BOTSv3 25k Stream Sample
Blended operational feed snapshot
|
CloudTrail + Sysmon + VPC Flow | 25,000 | 65.3% | 63.5% | ✓ 100% (60 / 60) |
|
Splunk BOTSv3 Enterprise Suite
Multi-tier attack simulation baseline
|
Blended CloudTrail + Sysmon | 4,559 | 73.0% | 67.6% | ✓ 100% (61 / 61) |
|
Splunk BOTSv3 Host Execution
Host process & heartbeat telemetry
|
Host Endpoint (Sysmon / EDR) | 3,616 | 79.1% | 76.9% | Baseline (0 attacks) |
|
Splunk BOTSv3 AWS CloudTrail
High-entropy mutating management APIs
|
AWS Control Plane API | 943 | 53.9% | 59.1% | ✓ 100% (61 / 61) |
When active intrusion payloads, defense-evasion CloudTrail API calls, or mutating IAM actions occur, Trevane automatically bypasses rollup folding. In these controlled public replay runs, 100% of tested attack events passed through uncollapsed so downstream Datadog monitors and Splunk correlation searches fire without alert suppression.
| Adversarial Scenario | MITRE ATT&CK Technique | Attack Events | Forwarded to SIEM | Aggregation | Alert Test Result |
|---|---|---|---|---|---|
|
Stratus Red Team
CloudTrail tampering attack
|
T1562.008 (StopLogging / DeleteTrail) |
3 | ✓ 3 / 3 (100%) | 0.0% Collapsed | Forwarded (Uncollapsed) |
|
Atomic Red Team
IAM privilege escalation backdoor
|
T1078 (CreateAccessKey) |
67
75 events total
|
✓ 67 / 67 (100%)
67 of 67 attack events forwarded (75 in total)
|
0% of attack events collapsed
(1 non-attack event folded)
|
Forwarded (Uncollapsed) |
We're working with a small number of design partners. The pilot is free for 60 days for up to 250 GB/day once Trevane is running on your logs, then discounted pricing for the first year. We start with the audit tool on one log export, then run Trevane next to your existing setup in dev or staging.
Flat annual licenses based on daily log volume — starting at $6,000 a year for up to 250 GB/day, with predictable volume tiers for terabyte-scale pipelines.