Traditional SIEM architectures were designed when security platforms could ingest, index, and query all logs in one system. As data volumes grow, that approach becomes expensive, and AI agents add unpredictable search demand because they follow alerts with new questions and reach into older data. Imply's answer is Lumi, a data platform for what the company calls the 'agentic SIEM.'
Lumi acts as a shared data layer beneath existing SIEM tools and AI agents, so organizations don't have to move everything into the SIEM first. It separates storage from compute, letting teams keep more history in low-cost object storage and scale search resources on demand. Users can query both indexed data and unstructured logs using familiar languages such as SPL and SQL.
Imply chief architect Eric Tschetter said the SIEM isn't going away, but the architecture underneath it has to change. He framed the opportunity as enabling organizations to retain and access significantly more security data while preserving the tools and workflows analysts rely on. Rafael Hass, security information manager at BTG Pactual, said in the announcement that Lumi lets his team ingest more data, retain it longer, pull telemetry from platforms beyond Splunk, and understand costs as they scale.