Overview
Last updated
Was this helpful?
Last updated
Was this helpful?
Self-hosted Scanner is a powerful option for running Scanner’s log analysis and detection capabilities entirely within your own AWS environment.
This article provides an overview of how Self-hosted Scanner works, how it’s deployed, and how it’s maintained over time.
Self-hosted Scanner brings the full power of Scanner’s compute infrastructure into your AWS account, offering the same functionality as our Managed Scanner (SaaS) solution, but with the added benefit of running entirely in your AWS account. This makes it an ideal choice for teams with strict security or compliance requirements that prevent reliance on external SaaS platforms.
Like Managed Scanner, Self-hosted Scanner processes and analyzes log data at scale, delivering fast search and real-time detections.
You interact with it through the familiar Scanner user interface, a single-page JavaScript application hosted on our AWS CloudFront CDN. The UI connects to WebSocket and HTTP servers running in your AWS account, ensuring a smooth experience while keeping your data and compute resources in-house.
Self-hosted Scanner utilizes Auth0 for authentication session management, ensuring that user access to the UI is both secure and seamless.
Key benefits include:
All data flows within your AWS environment: With Self-hosted Scanner, log data stays entirely within your AWS organization—moving securely between your S3 buckets and the Scanner AWS account via a VPC Gateway endpoint. No log data traverses the public internet, keeping your workflows fully internal.
Scaling without breaking the budget: Scanner scales effortlessly to index and analyze tens of terabytes per day, leveraging your AWS discounts and commitments for cost-effective growth—no budget surprises, even at enterprise scale.
Compliance for sensitive data: Since all data remains within your AWS environment, Self-hosted Scanner simplifies compliance with stringent requirements, offering greater control compared to SaaS solutions.
Compared to traditional SIEMs, Self-hosted Scanner offers 5-10x lower costs for high log volumes, with a pricing model based on terabytes indexed per day (TB/day). for details tailored to your needs.
Deploying Self-hosted Scanner is a process designed to get you up and running quickly with minimal effort on your part. Here’s how it works:
Setup by Scanner: Our team creates a new AWS account and provisions the necessary compute infrastructure—such as EC2 instances, ECS clusters, RDS databases, and S3 connectivity—in the AWS region of your choice (e.g., us-east-1). We recommend selecting the same region as your S3 buckets to avoid data transfer costs, using a VPC gateway endpoint for free, intra-region S3 access.
Account Transfer: Once configured, we transfer ownership of the AWS account from Scanner’s AWS organization to yours. This ensures you have full control over the environment.
S3 Bucket Integration: After the transfer, you’ll integrate the S3 buckets containing the logs you want Scanner to index and configure S3 import rules. This involves specifying which S3 buckets contain logs for Scanner to index and analyze, along with basic settings like timestamp extraction (via fields or regex) and optional transformations (e.g., normalizing to Elastic Common Schema - ECS).
Onboarding: Provisioning a new Self-Hosted Scanner AWS account typically takes one business day. Following the transfer, we schedule a 1-hour concierge onboarding session to help you integrate your first log sources and ensure everything is running smoothly.
The infrastructure auto-scales to handle your log volume, and while region selection is key, other settings are managed automatically. No advanced technical expertise is required—just a few straightforward steps to connect your data.
Once deployed, Self-hosted Scanner is a hands-off experience for your team. Our engineering and operations teams handle maintenance, updates, and scaling, so you can focus on using the insights Scanner provides. Here’s what to expect:
Automatic Updates: New versions of Scanner’s backend are deployed automatically by our team using a deployer IAM role retained in your AWS account.
Ops and Debugging: For tasks like debugging, running database migrations, or scaling infrastructure, our ops team may access your AWS account with temporary Assume Role sessions. You have full visibility into these actions via CloudTrail logs, and for specific data issues, you can invite a Scanner ops member to log in to your team's account via the Scanner UI (and remove them afterward).
No Customer Maintenance: You’re not responsible for any ongoing tasks—Scanner handles everything from infrastructure scaling to meeting service-level agreements (SLAs) for performance and reliability.
Support When You Need It: If an issue arises (e.g., a bug or outage), our team is alerted automatically and works to resolve it. You can reach us anytime via a private Slack channel, email, or our 24/7 emergency phone number for urgent matters.
Self-hosted Scanner combines the ease of a managed service with the flexibility of a self-hosted solution. It’s perfect for organizations needing to:
Meet compliance requirements - data storage and processing all remains within your AWS environment.
Leverage AWS budgets and discounts for compute infrastructure.
Process high log volumes affordably with Search and Detections features.
While you’re responsible for the AWS compute costs (which you can estimate based on log volume—), Scanner takes care of the rest. This balance gives you control over your budget and environment without the operational overhead.
To get started with deploying Self-hosted Scanner, . They will give you more information about the process, set up a Proof of Concept trial, learn about the problems you want to solve, and get you started.