LUnA · logrok universal agent

The universal agent that turns endpoint logs into detection

A single static binary for Windows, Linux, and macOS that ships logs to any destination — over syslog, OTLP, or Splunk HEC — and the front door to logrok's AI-driven log intelligence.

Book a demo Explore the platform

Windows Linux macOS

How it fits

From the edge, through a relay, into detection

Agents ship directly to logrok or any SIEM — or fan in through an optional relay/gateway for air-gap egress. Every hop is acknowledged, over syslog, OTLP, or Splunk HEC.

It ends in detection, not a database

Most collectors stop at moving logs into storage and a search box. logrok adds the layer above: AI-driven analysis, 1,000+ Sigma detection rules, threat intelligence, and compliance report packs. LUnA is how your endpoints reach it.

See the platform

A collector with a future

The agents many regulated fleets standardised on are being discontinued and pushed end-of-sale — forcing migrations no one asked for. LUnA is built to outlast them: Windows Event Log, files, journald, and syslog, with a config-mapping guide so you move without a rewrite.

Talk through a migration

Offline. No phone-home.

Sovereign networks can't tolerate an agent that calls a vendor portal to validate its licence. LUnA carries a signed, offline entitlement — no telemetry, no periodic check-in. Air-gap is a normal mode of operation, not a workaround.

How we prove it

Detection TE

Live detections · last 60s

Brute Force DetectedCRITICAL

142 failed SSH logins from 10.40.12.88 in 60 seconds

Rule AUTH-001 · MITRE T1110.001 · Target dc-prod-01

Privilege EscalationHIGH

svc_backup added to Domain Admins — no change ticket

Rule IAM-007 · MITRE T1078.002 · Event 4728

Suspicious PowerShellMEDIUM

Encoded command spawned by winword.exe

Rule EDR-114 · MITRE T1059.001 · ws-finance-07

Everything you'd expect from a serious collector

Collects from

Windows Event Log, ETW & WMI · journald & Linux audit · files · syslog, HTTP & MQTT · Kubernetes container logs · macOS unified log · and more

Ships to

RFC 5424 syslog (TLS/mTLS) · OTLP over gRPC or HTTP · Splunk HEC · Snare / MSWinEventLog · ack'd agent-to-agent relay · UDP diode · and more

Holds the line

On-disk spool with write-ahead durability · acknowledged delivery on OTLP, relay & HEC · ~8 MB static binary · under 50 MB RAM

Two ways to run it

Luna Core

Free

Non-commercial use, and free alongside logrok.

Linux syslog forwarding, unmanaged
File, journald & syslog inputs
JSON / CSV parsing, TLS output
Prometheus self-metrics

Luna Apex

Per agent· volume-banded

Priced ~20% under the legacy per-source agents it replaces — and no per-GB ingestion tax. Free with logrok.

Windows Event Log & Sysmon
Disk-spool durability, edge reduction
Per-agent mTLS with managed CA
macOS, Kubernetes, relay & air-gap diode

Standalone pricing is per agent, volume-banded — request a quote for your fleet. A full-feature trial is available on your real fleet.

See LUnA on your own fleet

Book a demo Explore the platform