Where Mainline runs
The same Mainline in each case: on your own servers, in containers and Kubernetes, or run for you as Mainline Cloud. You choose where your events live.
Available
Your infrastructure
Everything runs on your servers or in your cloud account. Nothing calls home.
- One installer
- For Linux on x86-64 or ARM, it sets up the console or a relay, and keeps the previous version, so rolling back is one command.
- Agents from the console
- Windows, Linux and macOS agents install with one command from the console, and upgrade from there.
- Air-gapped sites
- Licences are offline keys, and releases are signed files you carry in and check with one command.
- No single point of failure
- Relay groups of up to five, a standby console, and encrypted backups to your own storage.
Available
Containers and Kubernetes
The same Mainline, packaged for container platforms.
- A container image
- One small image with the console, relay and agent, running as a non-root user.
- Docker Compose
- A console and a relay for a lab, from one file.
- A Helm chart
- The console and relays on your Kubernetes cluster, with persistent storage for the relays' event store.
- AWS and Azure
- CloudFormation and Bicep templates that set up relays in your own account and network.
Available
Mainline Cloud
Mainline, run for you by Mainline Labs: all of it, or just the console.
- Fully hosted
- We run your console, relays and event storage. You install only agents, which send over HTTPS, each with its own credential, and hold events if your link drops. Cloud and SaaS APIs are collected from our side, with nothing to install.
- Console only
- We run your console, and your relays keep and deliver events inside your network: for sites where events mustn't leave.
- Your own instance
- Each customer gets a separate console, relays and storage, with its own keys. Nothing is shared with other customers.
- Your events, your rules
- Hosted events are encrypted in transit and at rest, kept for as long as you choose, delivered to your SIEMs, and exported or deleted when you leave.
- Nothing connects in
- Agents, and any relays you keep, connect out over TLS: no inbound firewall rules on your side. On ours, your hosted relays have their own addresses and accept connections only from your sites' addresses.
- Network devices
- Devices that send syslog over TLS send straight to your hosted relays. Plain syslog never crosses the internet: a Linux server at your site receives it, and the Mainline agent there sends it on over HTTPS.
- We run it
- Upgrades, backups and monitoring are ours. Single sign-on, two-factor sign-in and allowed address ranges are yours to set.
- Getting started
- Tell us about your environment, and we'll set up Mainline Cloud with you. Start with Mainline Cloud.
Compare
| Ways to run it | Your infrastructure | Containers and Kubernetes | Mainline Cloud, fully hosted | Mainline Cloud, console only |
|---|---|---|---|---|
| Status | Available | Available | Available | Available |
| The console runs | On your servers | On your cluster | At Mainline Labs, one per customer | At Mainline Labs, one per customer |
| Relays run | In your network | In your network | In Mainline Cloud | In your network |
| Your events are kept | On your relays and in your storage | On your relays and in your storage | In your own storage in Mainline Cloud | On your relays and in your storage |
| You install | The console, relays and agents | The chart, and agents | Agents only | Relays and agents |
| Upgrades | By you, with one command | By you, with the chart | By us | The console by us; relays from the console |
| Air-gapped | Yes | Yes, from your own registry | No | No: the console is reached over the internet |
| Best for | Teams that run their own servers, and air-gapped sites | Teams that run everything on containers | Teams that want to run nothing but agents | Teams whose events must stay in their own network |
Questions
Does Mainline Labs see our logs with Mainline Cloud?
That depends on the way you choose. Fully hosted, your events are stored for you in Mainline Cloud, in storage kept apart from every other customer's. With the console only, or self-hosted, they stay in your network: the console holds settings, health and the audit trail, and shows you search results read where your events are stored.
Do we need to open firewall ports?
No. Agents, and any relays you keep, connect out over TLS; nothing connects in. On our side, your hosted relays accept connections only from your sites' addresses.
What about firewalls and other devices that send syslog?
Devices that can send syslog over TLS send straight to your hosted relays. Plain syslog is unencrypted and easy to forge, so it never crosses the internet: a Linux server at your site receives it with rsyslog, and the Mainline agent on that server sends it on over HTTPS, holding events if the link drops. Or keep a relay at that site with the console-only option.
Can we start one way and move later?
Yes. Relays and agents are the same in every case. Moving the console means restoring its backup in the new place and giving relays and agents its address.
Which way should a pilot use?
Whichever you'd use in production. Self-hosted, most pilots start with one relay on a Linux server or virtual machine; fully hosted, a pilot needs only an agent on one server. Either way, it's sending the same day.
Start with one source and one destination.
A pilot runs on your own servers: pick a source that matters, a destination you use, and what success looks like. We'll help you set it up.