Natural language search, now in beta for Data Haven, lets anyone describe the events they need and see them in seconds, ready to resupply to any destination.
Reducing Shouldn’t Mean Losing Access
Teams use Realm to reduce what they send to the SIEM, and whatever they don’t send stays in Data Haven. Before most teams agree to reduce, though, they want to know how hard it will be to get that data back.
With a traditional archive, it’s hard. You can’t see what’s inside, so you pull a wide time range and hope the events you need are in there somewhere. If another team owns the archive, that pull starts with a ticket and a wait.
Data Haven was built to remove that friction. It’s the searchable retention layer of the Realm platform, keeping an immutable raw copy of your security data. Since search launched in July, security teams can search their full history directly in Realm, see results in seconds, and resupply only the events an investigation, incident, or audit calls for.
Introducing Natural Language Search
Natural language search removes the last barrier. You don’t need to know the schema or how to build a search. Describe what you’re looking for in plain language, and Realm returns the matching events from your full history, viewable right in the platform.
Once you have what you need, resupply it to any destination, whether that’s your SIEM, a data lake, or another tool, so you can keep investigating, meet a compliance request, or feed a detection workflow.
The same approach also opens Data Haven to agentic tools that need to pull from your log history directly.
Ask for cloudtrail requests to ssm-quicksetup.amazonaws.com within the last 7 days and Realm sets the source, time range, and condition for you. You can see exactly how your request was read, adjust it if needed, and have results in seconds. See how Data Haven works firsthand by clicking here.
Natural language search does not hand you an answer you have to take on faith. It hands you a query you can read, so if Realm reads a request differently than you meant, you see it before anything runs.
The builder is not going anywhere. Start in natural language and finish by hand, or the other way around.
Natural language search is available now in beta, at the top of the Search page in Data Haven.
Ready to See It on Your Data?
Pick one source, usually firewall logs. We do everything else and deliver your reduction, Detection Integrity, and ROI on your own data in a week.
