Scanner

Headed to AWS re:Invent? Come learn how Ramp and Notion are using Scanner's new MCP Server and AI to accelerate detection engineering.

Headed to AWS re:Invent? Come get a private demo of Scanner, the world's fastest security data lake, and check out how companies like Ramp and Notion are using our new MCP Server and AI to accelerate detection engineering.

Ramp turned a costly, limited log setup into a scalable security data lake. Learn how Ramp partnered with Scanner to boost visibility and empower engineers and security teams with fast, dependable log search and investigation.

Most security teams collect Okta logs - but few actually use them for detection. Buried in those events are high-signal indicators of real attacks. Learn how to turn Okta system logs into actionable security detections.

We ran real-world experiments to see whether LLMs could handle SOC investigations on their own. The results? AI is powerful - but only when paired with human judgement. Download the report to see what worked, what failed, and how to design AI-augmented investigations.

Today we're launching Scanner MCP: a new way to connect AI agents directly to your Security Data Lake. Traditional query engines force AI agents into 30-45 minute queries. That makes iterative investigation impossible. Scanner MCP changes that. With Scanner's indexed query engine, AI agents can search 100TB+ in seconds, for pennies instead of hundreds of dollars. And because Scanner MCP provides tools to return smart summaries instead of raw data dumps, agents can actually reason and iterate without hitting token limits. Built on the Model Context Protocol, Scanner MCP works with Claude Desktop, Claude Code, Cursor, and the Claude Agent SDK. Teams are already using it for: - Interactive threat investigations - AI-assisted detection engineering - Autonomous alert triage and enrichment Available now for all Scanner customers. Link to the full announcement in comments.