Reasoning memory for event streams

Catch the combinations your rules have never seen.

Engrammatic scores structured events as they arrive and sends a bounded novelty signal to your existing SIEM, log platform, or fraud stack. You keep the system of record. We add one source-specific encoder, one job, and one decision report.

evaluate a sample →see the guided pilot
AVAILABLE TODAY · PYTHON SDK + HOSTED SCORING
GUIDED PREVIEW · MANAGED REPLAY · IN-VPC FOR DESIGN PARTNERS
$1 / millionDeveloper scoring; contracted volume starts at $0.30/M.
One passEncode the event once instead of repeatedly scanning stored history.
CPU todayBinary vectors, XOR, and popcount on commodity compute.
Decision reportQuality, analyst burden, lineage, latency, and cost.
How it works

A scoring lane beside the stack you already run.

Engrammatic is a coprocessor, not a replacement for Splunk, Datadog, Hydrolix, a SIEM, or your data lake. It produces an anomaly candidate while the event is in motion; your existing tools retain, search, investigate, and enforce policy. Platform and OEM teams can embed the same lane without displacing customer storage.

01

Define one job

Start with one ordered stream and one detection objective. Keep behavioral fields; remove IDs, labels, secrets, timestamps, and post-event truth from the encoder.

sample + objective → encoder v1
02

Encode and compare

The job maps each event to a binary hypervector and compares it with a bounded set of learned prototypes using XOR and popcount.

event → binary vector → distance
03

Route the signal

Send high-novelty candidates to the alert or investigation path you already own. The profile, threshold, and model checksum stay versioned.

score + lineage → existing workflow
No vector database is required for the bounded model. At larger memory sizes, a compact sketch can shortlist prototype candidates before exact Hamming comparison. Engrammatic does not iterate over your raw log archive.
Where it fits

Use novelty for combinations. Keep simpler tools for simpler problems.

The evaluation is designed to let the simplest adequate route win. Engrammatic earns a place only when joint context matters and the measured alert burden is acceptable.

Evaluate Engrammatic when

  • Fields look normal alone, but an unseen combination can matter.
  • You have structured CDN, auth, RTB, RPC/web3, infrastructure, or operations events.
  • You need a cheap pre-filter before expensive search or analyst review.
  • You can provide a time-ordered replay and a useful outcome label or review process.

Use the existing baseline when

  • A threshold cleanly catches a 5xx spike or rate limit.
  • A z-score catches one numeric outlier.
  • A WAF, signature, or rule identifies a known attack.
  • A sketch or Bloom membership check matches or beats HDC on your holdout.
SecOps + observability

Novel access behavior

Flag a new service, path, identity state, and network combination before the full record lands in the investigation store.

auth + /login + 401 + new ASN + unusual device
Fraud + abuse

Behavioral fingerprints

Rank unfamiliar publisher, campaign, device, geography, and velocity combinations for downstream fraud verification.

candidate signal ≠ confirmed fraud
Infrastructure + web3

Operational drift

Detect a node version, chain or region, network state, and load combination that normal metric thresholds do not express.

node version + chain + region + load
Evidence before claims

Three gates decide whether a job should advance.

The console preserves the encoder fingerprint, model checksum, source digest, acceptance limits, and run receipt. Synthetic data can verify the workflow; only representative customer data can establish customer quality.

Quality gate

Chronological holdout

The first 60% builds the bounded shadow; the final 40% stays untouched. With a usable label, the report shows average precision, recall, and false alerts per 10,000 normal events.

Baseline gate

Let the simple route win

Compare HDC with frequency sketch and Bloom membership evidence. If the cheaper baseline wins on the declared objective, use it.

Operations gate

Measure the target system

Throughput, latency, resilience, and cost must pass on the selected AWS instance and region before a production claim is allowed.

CURRENT BOUNDARY · The SDK and hosted scoring API are available. Managed replay is a guided preview. In-VPC deployment is for design partners. A completed development run is not production qualification.
Guided evaluation

From sample to a go, tune, or stop decision.

Bring one stream and one question. We help define the encoder, freeze acceptance limits, run the untouched holdout, and return evidence you can challenge.

start in the console →scope a guided pilot
1
Bring an ordered replay

10,000–20,000 representative events for a first browser pass, plus a binary outcome label when available.

2
Create the encoder and job

Pin fields, numeric ranges, dimension, seed, routing, capacity, output, and retention to immutable versions.

3
Declare limits, then run

Set minimum average precision and recall plus the maximum alert burden before the holdout is scored.

4
Read the decision first

Advance, tune, or use the simpler baseline. Download the PDF with metrics, lineage, boundaries, and next steps.

Commercial + trust

Simple pricing. Explicit stage.

Start with a bounded evaluation. Production data, capacity, retention, deletion, and security requirements are agreed before the scope expands.

DeveloperSelf-serve hosted scoring
$1.00/M
GrowthGuided calibration and priority processing
$0.60/M
ScaleCommitted volume contract
from $0.30/M

Trust, without theatre

Data: hosted synchronous scoring runs in memory. Guided managed replay can durably stage bounded batches for retry and audit. In-VPC scoring is available to design partners.

Security: a DPA is available on request. SOC 2 Type II is on the roadmap, not claimed as complete.

Stage: Engrammatic is early and working with design partners. Production readiness is decided per job, not implied by the website.

Short answers

What evaluators usually ask.

Does anomaly mean fraud or an attack?

No. It means the field combination is unfamiliar under the attached profile. Customer labels, policy, and investigation establish meaning.

Do I replace my log platform or SIEM?

No. Engrammatic sits beside the ingest path and supplies a bounded novelty signal. Your existing platform remains the system of record and investigation surface.

Does one encoder work for every customer job?

No. An encoder belongs to one semantic context and one objective. Its fields, operators, dimension, seed, placement, and fingerprint are versioned and attached to the job.

What must pass before production?

Representative labelled quality, alert burden, target-instance throughput and latency, resilience, cost, security, and operating procedures. Development evidence does not waive those gates.

One stream. One encoder. One decision.

Find out whether combinatorial novelty earns a place in your stack.

Run a representative sample, compare the baselines, and keep Engrammatic only if the evidence supports it.

evaluate your logs →hello@engrammatic.ai