Gravwell

Gravwell is a full-stack security data platform and analytics engine purpose-built for organizations that need to collect, retain, and interrogate massive volumes of unstructured data without the cost penalties imposed by legacy SIEM products. Founded in 2017 by Corey Thuen and Kris Watts — both cybersecurity veterans who originally built the platform for their own needs — Gravwell ingests logs, metrics, raw binary, and any machine data in its native format without forcing schema normalization at ingest time. Its proprietary query language, Anko, allows security teams and analysts to perform advanced searches, correlations, and automated hunts across the entire data lake. Unlike competing platforms that charge per gigabyte ingested or per data source, Gravwell uses an indexer-based predictive pricing model that scales with infrastructure rather than data volume, making it practical for government agencies, defense contractors, and enterprises to retain all data rather than sampling or purging. The platform supports on-premises, cloud, and hybrid deployments and integrates with existing SIEM and SOC workflows. Gravwell is headquartered in Coeur d'Alene, Idaho, with a community edition available for individual researchers and small teams.