ClickHouse has put ClickHouse Security, an agentic security information and event management (SIEM) platform, into private preview. It brings AI-assisted security operations into ClickHouse Cloud, with threat detection, investigation and alert-triage tools built around customers’ existing ClickHouse services.
ClickHouse Watch analysis
What happened
ClickHouse says the platform provisions schemas and views on a selected ClickHouse Cloud service. Security teams can connect data sources, use built-in detections or write their own rules in SQL or Sigma, and create AI agents for alert triage, detection tuning and threat hunting. Natural-language chat lets team members ask follow-up questions without writing queries; teams can also build workflows using their chosen large language model through an MCP server, API, command-line interface or Slack bot.
The company says more than 100 integrations cover cloud, identity and SaaS sources, with built-in pipelines to filter, route and enrich logs. During the preview, the security product itself is free, but customers still pay standard ClickHouse Cloud compute and storage charges and must accept a preview addendum. ClickHouse says pricing for general availability has not yet been set.
The launch also changes the path for existing RunReveal SaaS customers. ClickHouse says it plans to help them move their data to independent ClickHouse services; customers will no longer be able to use RunReveal’s multi-tenant ClickHouse cluster in the future.
Why it matters
Security teams already collect mountains of logs, but getting useful answers can mean sending that data to another system and managing yet another pipeline. ClickHouse is pitching a different arrangement: keep the data on its cloud platform, then use built-in detections and AI agents to help investigate it. That could simplify operations for existing customers, although the announcement does not establish how well the product detects threats in practice.
The practical distinction for teams considering the preview is that “free” applies to ClickHouse Security, not the underlying cloud resources. And RunReveal customers should pay attention to the planned move away from the shared cluster, rather than assuming their current setup will carry on unchanged.
Our read
This is a substantial move from database infrastructure towards a more complete security product, with agents given real jobs rather than merely a seat at the marketing table. The hooks for custom rules, chosen models and existing data could make it useful to security teams already invested in ClickHouse. But a private preview is still a trial, not a verdict on detection quality or operating costs. If you are eligible, the useful test is whether it finds and explains threats in your own data, and what that costs once the compute bill arrives.
What to watch
- Which regions and capabilities ClickHouse adds before general availability.
- How preview users assess detection quality, investigation speed and total cloud costs.
- How RunReveal customers will migrate their data and when the shared-cluster option will end.
Discussion spark: For security teams already using ClickHouse, is keeping SIEM data on the same platform worth trying AI agents on it, or should detection quality be proven before teams consolidate?
Sources and evidence
- Source update (9 November 2026, 16:59 UTC)
Independent WittyWires tracker for public updates about ClickHouse. Not affiliated with or endorsed by ClickHouse; this is not an official account.