Every commercial EDR vendor will tell you their detections are world-class, their telemetry handling is bulletproof, and their roadmap is yours. You will never see the code. Project Mimir is the opposite of that.
Closed-source EDR is a vendor saying trust us on the same call where they're describing their zero-trust architecture. We're not going to do that.
Open the pack, read the SQL, see exactly what's matched and why. No "the model said so."
One binary in your VPC, your Postgres, your retention policy. A vendor breach doesn't include your fleet.
Standard SQL, standard transport, standard outbound webhooks. Nothing magical, nothing locked.
Industry-typical pricing, applied to a 25,000-endpoint fleet, billed by the second. Project Mimir's bill, over the same window: $0.00.
spent on commercial EDR since you opened this page — assuming a 25k-endpoint fleet at the typical $48/endpoint/year rack rate.
Project Mimir is the same primitives the SaaS vendors charge you for, with the auditability they can't offer and the integrations you actually wanted. Real value, the moment the binary starts.
Enroll, deploy the agent, query in under an hour. No professional services SOW. No "kickoff call."
Drift detection, ad-hoc SQL across thousands of hosts, IOC matching against your indicators — the things commercial EDR makes hard or expensive.
Outbound webhooks to Splunk, Elastic, Datadog, anything that takes JSON. Project Mimir is a sensor, not a destination — point it wherever you already operate.
One static binary. Postgres + Redis. In your VPC. The agent reports to you, not to a third party that happens to host you.
Built by security teams tired of shipping their fleet's secrets to a vendor. Issues, PRs, and roadmap are all in the open.
Apache 2.0 / BSL 1.1. No "open core." No premium tier dangling the actual feature you need behind a sales rep.
Clone the repo, run one binary, point your hosts at it. The whole thing is sitting on GitHub, waiting.