---
title: ClickHouse Security
description: 'The security data platform built on ClickHouse: collect, detect, and investigate in one SIEM, then build agentic workflows on the same data.'
---

# The agentic SIEM built for scale

Collect, detect, and investigate in one platform, on the database built for large-volume, high-speed workloads. Then build agentic workflows on the same data.

Now in private preview.

- Hundreds of first-party integrations, ready to query on arrival
- Native pipelines, no third-party tools required
- Built-in, managed detections, plus custom SQL and Sigma rules
- MCP server, AI chat, Slack bot, CLI, and API access

[Request access](https://clickhouse.com/security#request-access)

## Start with a SIEM that has the essentials built in. Then use AI to keep pace with modern threats.

### Foundational data management

- Hundreds of first-party integrations, normalized and ready to query on arrival
- Filter, route, and drop data with built-in pipelines
- Managed and custom SQL detections-as-code

### Flexibility to build in the AI era

- Native AI agent that automatically triages and investigates alerts
- Bring-your-own-LLM support
- Leverage your data from the MCP server, native AI chat, Slack bot, CLI, or API

## From raw logs to resolved cases

### Data collection and pipelines

Connect first-party integrations or send custom logs. Pipelines filter, route, normalize, and enrich events as they arrive, using a visual builder with SQL for advanced cases. Events land in ClickHouse, with raw data preserved.

### Detections and alerts

Start with built-in, managed detections for common threats across cloud, identity, and SaaS. Extend them with standard SQL or Sigma rules that evaluate events as they stream in, then route alerts by severity to Slack, PagerDuty, or any webhook.

### AI investigations

Alerts open cases automatically. AI agents pull logs, query your data, and write their findings and reasoning back to the case, so analysts start from context instead of a blank page.

[Request access](https://clickhouse.com/security#request-access)

## Build and run agents that use your security data to solve real problems

Agents triage and investigate your alerts out of the box. Build your own to handle response, threat hunting, and detection coverage.

### Autonomous triage

Alerts automatically trigger agents to gather context and investigate incidents.

### Chat with your agent in app or Slack

Ask questions of your logs in natural language, wherever your team works.

### Transparent and governed

See which logs were analyzed and why. Control models and permissions per agent.

### AI detection engineering

Generate rules from descriptions, audit coverage, and tune noisy detections.

## Why ClickHouse Security

|                    | Before                                      | With ClickHouse Security                                                                   |
| ------------------ | ------------------------------------------- | ------------------------------------------------------------------------------------------ |
| Investigations     | 3+ hours of manual log correlation          | AI gathers context and correlates events, cutting investigations to minutes                |
| Detection coverage | Custom rules written for every threat       | Built-in library covers common threats with the option for custom SQL and Sigma detections |
| Time to value      | Weeks or months integrating sources         | Connect sources and start detecting quickly                                                |
| Pipelines          | Hand-built pipelines per log source         | Built-in filtering, routing, enrichment, and normalization                                 |
| Tooling            | Separate SIEM, pipeline, and AI SOC vendors | One platform for ingestion through AI investigations                                       |

## Request access to ClickHouse Security

See the full platform on your own data. We’ll get you started with a trial or a guided demo.

[Request access](https://clickhouse.com/security#request-access)