ClickHouse welcomes RunReveal

Summary

ClickHouse has acquired RunReveal, a company that built a security data platform on ClickHouse, and says the team’s expertise will become part of its work in security. The announcement frames security as a demanding data workload involving cloud audit logs, identity events, endpoint telemetry, and network flows, with continuous high-throughput ingest, years-long retention, and interactive query requirements. ClickHouse says the acquisition will bring sharper reference architectures, guidance on schema and retention design, and a clearer connection between customer requirements and its database roadmap, while RunReveal remains available through a bring-your-own-database model. Existing RunReveal customers will continue to receive platform support under unchanged contract terms, and the team’s work on agentic investigation is expected to inform support for analytics involving agents that hunt across sources, tune detections, and advance investigations.

Context

Security workloads combine high-volume data sources with continuous ingest, retention measured in years, and queries that need to return while an analyst is still viewing the results. The announcement also identifies emerging machine-speed threats and the need for investigations that can move faster.

Approach / What changed

ClickHouse acquired RunReveal and is bringing its security expertise in-house. It plans to improve reference architectures, schema and retention guidance, and the connection between customer requirements and the database roadmap, while continuing RunReveal’s bring-your-own-database platform and supporting existing customers under the same contract terms.

Takeaways

• RunReveal’s platform remains available through a bring-your-own-database model, with security data stored in a ClickHouse cluster controlled by the customer.
• Existing RunReveal customers will continue receiving platform support, and their contract terms remain unchanged.
• RunReveal’s agentic investigation work includes agents that hunt across sources, propose and tune detections, and carry investigations toward a conclusion.

Related reading