Skip to content

Deployment

Run it where your data lives.

Fully on-premises, armor360’s own AI model included, or run for you. The same platform either way, and your people review and decide.

Start a free pilotSee pricing
Installed in your networkServer in your networkPlatform installedOur model running on your hardwareConnected to your SIEM, read-onlyBusiness context addedFirst alerts looked intoYour serverPlatformModelConnectorsElastic SecuritySplunkMicrosoft SentinelCrowdStrike FalconRead-only connections
Illustrated example of an on-premises install. armor360 reads from your tools; it does not change them.

Two ways to run it.

TopicOn-premisesHosted for you
Where it runsOn your hardware, inside your network, beside your SIEM Run for you by armor360, connected to your tools
The AI modelarmor360’s own model, on your hardware armor360’s own model, run for you
Alert dataStays inside your network with the fallback off Read from your tools over the connections you set up
HardwareA GPU server you provide, sized with you in the quote None for you to buy or run

From first call to the first verdicts.

  1. 1

    Size it

    We size the hardware or the hosted service from your alert volumes and the systems you want watched, and you get a quote.

  2. 2

    Tell it about your estate

    Four inputs: a sheet of your systems, a sheet of your business processes, the connection to your SIEM and, if you have them, threat-list keys.

  3. 3

    It reads, you approve

    It reads your logs, machines, log collection and rules, then talks the gaps through with you. Nothing is saved or switched on without your click.

  4. 4

    First verdicts

    New alerts are collected and investigated as they arrive, and the people you chose are told about the ones that need them.

What a deployment includes.

  • The whole platform

    Triage, investigation, campaigns, hunting, detection rules, coverage and reports. Nothing is a separate product.

  • Its own AI model

    Fine-tuned by our team for security investigation, and run on your hardware when you run on-premises.

  • Elastic first

    Elastic Security alerts and logs, searched where they are. Splunk, Sentinel, CrowdStrike and Defender send their alerts in.

  • Your channels

    Findings to Slack, Microsoft Teams, PagerDuty, email, Jira, ServiceNow or a webhook.

  • Your sign-on

    Okta, Microsoft Entra ID or any OIDC provider, or passwords with a second step.

  • Many customers, if you need it

    Managed providers run each customer in a space of its own, with its own tools, model and people.

Frequently asked questions

What hardware does an on-premises install need?

A server with a GPU for the AI model, sized from how many alerts you handle and how quickly you want each one looked into. We size it with you as part of the quote. In our lab, the whole platform and its model run on a single NVIDIA DGX Spark.

Do we need to move our logs?

No. With Elastic Security the agent searches your logs where they already are. Other tools send their alerts in, and nothing is copied into a new store first.

What does our team do during set-up?

Fill in two sheets, about your systems and your business processes, connect your SIEM, then answer the set-up conversation’s questions and approve what you want switched on. Everything else, reading your logs, machines and rules, runs by itself.

What does a fully internal deployment need?

The AI model running on your own hardware, the cloud fallback switched off, and a review of the outbound connections you keep, such as threat-intelligence lookups and notifications. The model and any fine-tuning are agreed as part of the deployment.

Read next

See where your team’s time goes. Then decide.

Start a free pilot on your own alerts, or put in your own numbers first.

Start a free pilotRun your numbers