Compress at the edge. Query without re-ingesting.
Sasquatch sits inside your cluster. Logs, traces, and metrics are compressed against a model trained on your own schema, severity-routed in real time, and dropped into your bucket. Pull any time range back through Tap Out — no second ingestion fee, no rehydration tier.
Three commands. No migration. No pipeline.
Nothing to rearchitect. No Terraform sprint. No “log pipeline modernization project.” Copy three lines, watch the dashboard drop, go to your next meeting.
Install, init, helm. That's the whole runbook — no Confluence page required.
From curl to first compressed chunk in the bucket. Coffee still warm.
Deploys as a DaemonSet alongside your existing log path. Roll back anytime.
They rent your logs back to you. We don’t.
Your logs and traces live in your bucket, under your KMS keys, inside your VPC, subject to your lifecycle policy. We compress them in place and never hold a copy. When you need them back, two lanes: Tap Out pulls any range as raw NDJSON in seconds, and live queries answer from Grafana, Splunk, Datadog, or the native Snowman console — sub-second, no re-ingestion.
- —Pay to send them
- —Pay to index them
- —Pay to keep them
- —Pay to read them back
- —Pay to leave
- Your bucket
- Your KMS keys
- Your VPC endpoint
- Your lifecycle policy
- Your Tap Out, anytime
Bulk retrieval
Pull any time range as flat NDJSON. Stream it anywhere — another SIEM, a laptop, a compliance archive.
- Interface
- sasquatch tap-out · REST
- Output
- NDJSON, one event per line
- Latency
- seconds for GB-scale ranges
- Used by
- audit exports · SIEM migration · forensic dumps
Interactive search
Point Grafana, Splunk, Datadog, or Snowman at the query engine. It reads the same chunks — no re-ingestion, no search-compute line.
- Interface
- Loki · Tempo · Splunk · PromQL · native
- Output
- dashboard panels · Explore rows
- Latency
- sub-second for typical windows
- Used by
- day-to-day debugging · live incidents · compliance checks
Live incident, 3-month-old clue
Pull 72 hours of logs from January in under 30 seconds. Every field intact, events in order. Forward straight to the SIEM the on-call is already staring at.
Audit or eDiscovery request
Give auditors original records, not summaries. SHA-256 verified on every event. Courts accept it. Auditors accept it. Nobody asks "where did the rest go?"
Migrating off a SIEM
Replay your full log history into the new system. Your compressed archive becomes the migration source — no gap, no re-ingest fee, no left-behind months.