Three Ways Data Gets In Before any of the architecture matters, data has to actually arrive. RunReveal supports three ingestion methods, and which one a given source uses isn't a style choice — it changes what happens when something goes wrong. Webhook — push-based. The source sends events to a URL RunReveal gives you. Fast and simple, but if the network hiccups mid-send, that event is gone. No retry, no replay. Polling — RunReveal reaches out to the source on an interval, r

The Interface Sitting on Top of Everything in Part 2 Part 2 covered the logs table and the ClickHouse foundation underneath RunReveal. This part covers how you actually touch that table day to day — the Explorer, RunReveal's log search and query interface. It's easy to undersell this as "just a search bar," and I almost did exactly that in the first article of this series before realizing how much is actually packed into it. RunReveal's own description calls it a compact, sin

Why ClickHouse The first thing I wanted to understand about RunReveal wasn't the UI — it was what's actually underneath it. Most SIEMs I've worked with are built on some flavor of a log indexer: Splunk has its buckets and indexers, Sentinel sits on top of Azure Log Analytics workspaces. Those architectures were designed in an era where the assumption was you'd mostly search for specific terms across a lot of unstructured text. RunReveal is built directly on ClickHouse, a col

I want to be upfront about where I'm coming from before I say anything else: I'm not an AI skeptic. I run AI agents most of my working day, and I've built plenty of them for different tasks. I use them for a lot — building internal tools, troubleshooting, you name it. Half the projects on my plate right now exist because an AI agent worked alongside me, troubleshot with me, and knocked out in a few days what would've taken months. So when I say the Hugging Face breach worried

The Problem Nobody Loves Admitting Every SOC analyst I know has a version of the same complaint. Splunk gets expensive the moment your log volume grows past whatever number your finance team quietly panicked about last renewal. Sentinel is great if your entire estate lives in Azure and painful the moment it doesn't. And half the SIEMs on the market still feel like they were built for a world where a 'query' meant clicking through six dropdown menus instead of just writing SQL