Engrammatic scores structured CDN, auth and operations events as they arrive. It supplies a combinatorial-novelty signal beside Hydrolix, Splunk, Datadog or your data lake—then reports alert burden, held-out quality, latency and cost so you can decide whether a source-specific profile is safe to pilot.
Many detection stacks analyze events only after collection, indexing and storage. That is the right path for search and investigation; it is a different path from assigning one bounded novelty score while the event is already in motion.
Query-based detection re-scans and decompresses the same events for every rule and lookback window.
Low-latency query detection often keeps both data and compute warm. The utilization and cost trade-off should be measured on your workload.
Platform bills rarely isolate one detector's true cost, queue delay and analyst burden. A pilot should measure all three.
Most teams approximate ingest-time novelty detection with blunter tools. Here's what you'd otherwise reach for — and the gap each one leaves.
Prometheus, CloudWatch, CDN analytics. Cheap — but per-metric. A brand-new field combination that's individually normal sails straight through, and you live in threshold-maintenance.
Splunk, Elastic, Datadog, Hydrolix. Flexible — but repeated scans and lookbacks are a different cost and latency path from scoring once at ingest.
FAISS, Milvus, Pinecone. Rich embeddings and approximate-neighbour indexes can work well, with a different inference, index and operations envelope. Compare both on the same stream.
Flink + RRCF / River. It works — but now you build and operate a detection platform. We're the kernel (XOR + popcount), not a platform you run.
Encode each event once at ingest and score combinatorial novelty with XOR + popcount. Developer scoring is $1/M events; committed volume tiers reach $0.30/M. Hosted and managed processing use the same plan-priced balance. It sits alongside your stack: your dashboards still graph and your store still queries.
Use the right tool. A 5xx spike → a threshold. A single numeric outlier → a z-score (it'll beat us, and we'll say so). A known attack → a WAF. Use Engrammatic for the never-seen-before combination none of those catch.
You could build this. The bit operations are simple; the product work is encoder design, memory policy, drift monitoring, idempotent ingestion and false-alert control. A guided pilot exists to determine whether that maintained system is worth buying for your source.
Engrammatic sits beside the ingest path. A versioned, source-specific encoder turns each structured event or bounded entity window into a 10,240-bit binary hypervector. Similarity becomes XOR + popcount; the profile still has to pass a labelled holdout.
A coprocessor, not a replacement. Your log platform stays the system of record for storage, SQL, dashboards and compliance. Engrammatic adds a bounded novelty signal at ingest; the pilot measures whether it improves your workflow.
Engrammatic has a hosted scoring API and zero-dependency Python client. pip install engrammatic, sign in for an API key and test structured events. Managed replay is a guided-preview path: availability is shown in the console, and intake fails closed when authoritative worker telemetry is disconnected. In-VPC scoring remains a design-partner deployment.
pip install → sign in for a key ($20 credit) → detect() against the hosted API → benchmark your own logs.
Zero-dependency Python client from PyPI. Sign in with Google for an API key — new accounts get $20 of starting credit.
Request a sandbox key, send events to the endpoint, see anomalies and your live bill. Metered per million events — no commitment.
Spot-only or contracted warm capacity, in your AWS account or ours. The fleet policy, cost ceiling, queue SLO and rollback are agreed before launch.
Cold and warm capacity are different products. Spot minimizes compute cost, but startup time varies. Work that needs a startup guarantee uses a separately priced, contracted warm-capacity SLO.
Pre-filter and triage structured logs at ingest. Catch novel combinations and send a smaller, explainable stream into investigation.
Candidate signals for fraud and abuse workflows. Engrammatic ranks unusual behavior; customer labels, context and policy determine whether activity is fraudulent.
Flag never-before-seen behavior and monitor whether score distributions, recall and alert volume drift over time.
Include platform compute, queue delay, query/storage overhead and analyst time. Enter your own per-million baseline below.
$0.60/M Growth · committed Scale volume from $0.30/M. One plan-priced balance covers hosted and managed processing.
One balance, clear plan pricing: hosted API calls and managed replays are billed by scored logical records at your plan rate. Managed runs retain explicit worker, lifetime, and launch safety limits without creating a second customer balance.
See the exact account-balance charge by plan and compare it with a per-million baseline you control. The same plan rate applies whether processing is hosted or managed.
Account-balance arithmetic only—not a quote. If your current system is cheaper or a threshold solves the problem, keep it. A guided run supplies the source-specific quality, analyst-load, throughput, and latency evidence needed for a fair decision.
open the console → benchmark your logsFive primitives — encode · bind · bundle · write · query — plus a one-line detect(). Run it in-process for benchmarking, or point it at the hosted service.
Event scoring uses one prepaid account balance across hosted and managed processing. Developer is $1/M; contracted volume lowers the rate.
Top up by card in the console today. USDC/USDT (Base · Arbitrum · Solana · Tron · Ethereum) coming with a real processor. Teams can pay by invoice (ACH / wire).
You sign in with Google; Stripe handles card details and checkout. Engrammatic stores the account identity, ledger and usage records needed to authenticate and meter the service.
Run your own logs through Engrammatic to get cost per million, queue and worker latency, false alerts per 10,000 normal units, and held-out detection quality. A tuned threshold or batch baseline can beat us, and the report says so when it does. Our edge is per-event combinatorial novelty as events arrive. The production gate is your source-specific, time-ordered holdout—not a synthetic headline.
sign in with Google — every new account starts with $20 of sandbox credit. Questions? hello@engrammatic.ai
Public notes cover announced product releases, practical HDC explainers and analysis grounded in public primary sources. Customer and internal validation stays private in the account's console and run reports.
Engrammatic starts with one concrete job: deterministic combinatorial-novelty scoring for structured event streams on commodity CPU. Hyperdimensional representations may support broader associative-memory products later, but today the product is the narrow, measurable coprocessor described above.
Engrammatic is early — we're running design-partner pilots, not pretending to be a mature SaaS. Here's exactly what that means for your data and your security review.
For design partners, in-VPC deployment keeps raw events inside your network. Hosted synchronous scoring runs in memory; managed replay durably stages bounded input batches for retry and audit. Retention, redaction and deletion are agreed before production data moves.
SOC 2 Type II is on the roadmap; a DPA is available on request. Identity, payment and regulatory requirements are documented for the deployment instead of implied by certifications or screening programs we do not yet operate.
Python SDK and hosted synchronous scoring are available today. Public OTLP/HTTP JSON, durable managed Spot replay and signed webhook destinations are available in guided preview. Kafka, Kinesis, S3 and vendor collectors remain roadmap work.
Commercial answers first. Technical concepts are last.
Engrammatic scores combinatorial novelty: a path, ASN, device, account state or other set of fields that may each be familiar but have not appeared together for that source and profile. Use a threshold for a 5xx spike, a z-score for one numeric outlier, and a WAF or signature engine for a known attack. Engrammatic supplies a candidate signal beside those tools.
No. A novelty score says the event or entity window differs from the profile's bounded memory. Fraud requires customer labels, context and policy. For CDN abuse, useful fields often include account/session/token or entitlement state, asset, PoP, ASN, geo, device and request sequence—not just an HTTP status.
Guided customer pilot: yes. General self-service production ingestion: not yet claimed. A pilot requires a source-specific, time-ordered labelled holdout, a frozen versioned profile, an alert-volume gate, canary monitoring and rollback. Your validation results and limitations stay in your authenticated console and run report.
The guided managed path accepts structured OTLP/HTTP JSON through the public TLS endpoint with API-key authentication, durable idempotency and bounded backpressure. Alerts can go to account-scoped signed HTTPS webhooks with retry and dead-letter history. Raw lines should be parsed into stable fields first. Kafka, Kinesis, S3 and vendor collectors are not all live; a pilot defines the exact source, retry contract and destination before traffic moves.
No. Profiles do not transfer reliably across unrelated log sources. Bounded categorical memory and alert budgets may adapt online. Field roles, entity keys, numeric ranges, weights, temporal features and thresholds do not mutate silently: candidates train in shadow, pass a customer-specific held-out gate, canary, then become a new version.
Every owned run has a decision-first PDF and console view. Labelled evaluations report TP, FP, TN, FN, F1, precision, recall, PR-AUC, MCC, false alerts per 10,000 normal units, calibration and drift. Load reports separate admission, queue wait, worker time, end-to-end throughput and cost. Distinct HDC encodes shows how much unique representation work occurred, so repeated synthetic templates cannot masquerade as high-cardinality real-log throughput.
Developer event scoring is $1/M, Growth is $0.60/M, and committed Scale volume starts at $0.30/M. Hosted and managed processing draw from one prepaid balance at that plan rate. Every managed run also has explicit worker, lifetime, and launch safety limits.
Cold Spot minimizes compute cost, but variable startup time can dominate short jobs. If startup time matters, contract a warm-capacity SLO. Your run report separates queue delay from worker execution so the trade-off is visible without exposing another customer's measurements.
Hosted synchronous scoring handles records in memory. Managed replay durably stores bounded input batches so retries, completion and account-owned evidence remain exact; its retention is scoped in the pilot agreement. In-VPC design-partner deployment keeps raw events in your network. A DPA is available on request; SOC 2 Type II is a roadmap item, not a current certification.
Hyperdimensional computing represents an event or bounded window as a high-dimensional binary vector. Field/value pairs bind and bundle into one representation; distance becomes XOR plus popcount. That makes comparison cheap and deterministic, but encoder design and operating-point calibration—not the bit operation alone—determine whether the signal is useful.