Every edition collects and archives logs; what changes is how much you can do with them. All four are licensed by EPS, deploy on-premises or as SaaS, and include 18 months of retention.
An upgrade is a licence change, not a migration.
Lite
Every log kept, provably unchanged, for as long as the law requires — and forwarded onward if you already have a SIEM.
For: a retention obligation to satisfy, or an existing SIEM that needs affordable long-term storage behind it.
LogMan.io
Logs become usable: parsed, searchable, on dashboards, in scheduled reports, with operational alerting on top.
For: IT operations that troubleshoot from logs and report to auditors.
LogMan.io PLUS
Everything above, plus a working detection capability — up to 15 detections and full incident handling.
For: organisations under NIS2 that must demonstrate detection without running a SOC.
LogMan.io SIEM
No detection cap, the complete content library, threat intelligence, asset context and hunting across history.
For: security teams running active detection, investigation and response.
| Capability | Lite | LogMan.io | PLUS | SIEM |
|---|---|---|---|---|
| Collection & archive | ||||
| Log collection350+ supported source types | Yes | Yes | Yes | Yes |
| Immutable raw-log archiveAppend-only, tamper-evident | Yes | Yes | Yes | Yes |
| Retention included in the price | 18 months | 18 months | 18 months | 18 months |
| Compliance evidenceNIS2, Act 181/2014, Decree 82/2018, ISO 27001 | Yes | Yes | Yes | Yes |
| Forwarding to an external SIEMQRadar, Sentinel, Event Hub | Yes | Yes | Yes | Yes |
| Parsing and normalisation | No | Yes | Yes | Yes |
| Custom parsersDeclarative, in SP-Lang | No | Yes | Yes | Yes |
| Search, reporting & analysis | ||||
| Full-text searchAcross live and archived events | No | Yes | Yes | Yes |
| Dashboards and visualisations | No | unlimited | unlimited | unlimited |
| Scheduled reports and exports | No | Yes | Yes | Yes |
| Lookups and watchlists | No | Yes | Yes | Yes |
| Detection & response | ||||
| Operational alertingLog source silence, thresholds, service health | No | Yes | Yes | Yes |
| Security detections and correlation rules | No | No | up to 15 | unlimited |
| Detection content librarySigma rules, mapped to MITRE ATT&CK | No | No | selected set | full library |
| Alert and incident managementTickets, ownership, SLA, suppression | No | No | Yes | Yes |
| Behavioural baseliningAnomalies against learned normal | No | No | Yes | Yes |
| Threat intelligence feeds | No | No | selected feeds | full |
| Asset inventory and entity risk scoring | No | No | No | Yes |
| Retrospective huntingNew detections replayed over the archive | No | No | No | Yes |
| Automatic event categorisationSecurity taxonomy across sources | No | No | No | Yes |
| Artificial intelligence (AI) | ||||
| AI extensionAgentic AI, licensed as an add-on | No | No | optional | optional |
| Autonomous alert investigationEvery alert investigated, reasoning shown, ranked by real risk | No | No | with AI extension | with AI extension |
| AI-driven threat hunting | No | No | with AI extension | with AI extension |
| AI deploymentOpen-weight models operated by TeskaLabs | No | No | on-prem / sovereign AI cloud | on-prem / sovereign AI cloud |
| Platform & commercial | ||||
| Deployment | on-prem / SaaS | on-prem / SaaS | on-prem / SaaS | on-prem / SaaS |
| Throughput | 500 000+ EPS | 500 000+ EPS | 500 000+ EPS | 500 000+ EPS |
| Multi-tenancy | Yes | Yes | Yes | Yes |
| Single sign-on, Active Directory, RBAC | Yes | Yes | Yes | Yes |
| Licensing metric | EPS | EPS | EPS | EPS |
| Upgrade path | → LogMan.io | → PLUS | → SIEM | No |
Lite → LogMan.io
Parsing turns raw lines into fields; search, dashboards and scheduled reports turn fields into answers.
LogMan.io → PLUS
Alerting stops being operational and becomes security. Up to 15 detections run against the live stream, and what they raise is handled as an incident with an owner and an SLA.
PLUS → SIEM
The full Sigma library, threat intelligence, asset and identity risk context, and the ability to replay a new detection across everything already archived.
Tell us your event volumes, your sources and what you have to prove to an auditor. Our engineers will tell you which edition covers it — including when the answer is the cheapest one.
Tell us about your log volumes and sources, and one of the engineers who built LogMan.io will get back to you — usually within one working day.
One of our engineers will be in touch shortly. If it's urgent, call us on +420 604 806 483.
