Self-training
Point a feed at it. Useful after the first pass, sharper every day after.
Squirks Know your normal
Your baseline shouldn’t be a document. It should be math.
Point a data stream at Squirks and it learns, on your own hardware, what that stream actually does. From then on every event is measured against that expectation. The routine sinks. Anything your systems have never done floats to the top — with a number that says how far from normal it landed.
Distance from expected, in bits.
score(e) = −log₂ P(e). Not a tuned severity guess — a computed quantity that shows its work. Normal sinks. Novel floats.
A model per feed
Every source gets its own, so patterns never fight. Small, fast, and specific.
Fully local
Your GPU, your data, your building. No vendor in the loop.
Defensible
Every score is a derivation you can walk an auditor through.
They pick the curriculum. We study you instead.
Anything trained on adversary behavior is trained on data the adversary chose to release. Squirks never studies them. It studies you — the dataset they don’t control, can’t withhold, and can’t outproduce.
If it moved through the stream, it was measured.
Behavioral tools often baseline only the fields somebody chose to parse. Squirks baselines the bytes themselves — no schema to invent, no parser to write when you add a source. Works on raw byte streams without a parser for each record format.
Where the line is.
- Coverage stops being a budget decision. Volume-priced tools make you choose what you can afford to watch. Squirks scores in flight, before anything is written down — widening coverage costs compute, not gigabytes. Teams also dial logging down — Info to Warning — and lose signal. Same tax.
- It finds what nobody wrote a rule for. Signatures catch what someone already anticipated. A probability needs no anticipation: whatever your stream has never done is unusual by definition.
- A model per feed keeps every model sharp. Nothing competes for representation.
- Nothing leaves the building. Model, data, and scoring stay inside your fence.
- The long tail settles into the background. What your systems do ten thousand times a day carries little information — and here that isn’t a forgotten filter, it’s arithmetic.
- Triage is included, and you write the context. An LLM sits downstream of the score and labels what surfaces — threat, fault, or benign novelty — in your language, with your priorities.
- You don’t need a data lake to start. The interface stands on its own. If you already own a SIEM or archive, Squirks makes it cheaper by sending onward only what earned the storage.
Priced by the GPU you run — not the data you send through it.
Capacity is a decision you make once, not a meter that charges you for wanting to see more.
A base layer your tools can talk to.
Squirks is the base layer: normal and surprise on bytes. On that layer you add labels — including matching with embeddings — and LLM analysis through agents. That can recreate some of the most useful SIEM-style analytics without pretending Squirks is a SIEM or shipping a SIEM-like console.
We expose MCP so your SIEM — or other tools — can talk to Squirks, pull ranked findings, and keep your existing workflow.
You can evaluate streams your volume-priced ingest can’t fully absorb, send only the events you choose into higher-cost storage, and keep investigating the rest in Squirks — without replacing your existing SIEM.
Squirks sits alongside EDR and identity tools; those tools still cover misuse of legitimate access.
It measures how unusual something is — not what someone meant.
Whether an unusual event is an intrusion, a misconfiguration, or a Tuesday is a call your analyst or your triage prompt makes. Squirks opens tickets with full derivation. It never closes one on the model’s authority.
Baselining normal behavior isn’t a badge — it’s a standing control expectation (NIST 800-53 SI-4 and related). Squirks is how you do it in practice, not only on paper.
Ask to see it run.
Deployed and defending a live system today.