FAQ

Is Keel SaaS or self-hosted? Self-hosted. You run it as a VM on your own hypervisor — in your datacenter or your own cloud. Your log data stays in your environment; it is never a vendor SaaS. For AI, only the context for that request goes to the model endpoint you configure — or run a local model and nothing leaves at all.

How is Keel delivered? 100% digitally — a downloadable VM image (OVA / VHDX / QCOW2) from the customer portal. There is no physical media.

What hypervisors are supported? VMware, Hyper-V, KVM/Proxmox, OpenStack, OpenShift Virtualization, and compatible platforms that can import an OVA, VHDX, or QCOW2 and attach a second virtual disk. See system requirements.

How do I ask Keel questions? From the home screen. Platform Intelligence gives you an Ask Keel anything bar — type a question in plain English ("show auth failures in the last hour") and Keel investigates and answers with the underlying logs as proof. In Explore, Dynamic Charts with AI turns a question into a chart. The built-in assistant can also act — create a source, draft a detection — but every configuration change asks you to confirm, is RBAC-scoped, and is audited.

Can I connect my own AI agent? Yes. Keel ships a Model Context Protocol (MCP) server, so any MCP-compatible assistant or agent — Claude, Cursor, or your own — can query your logs and Keel's analysis. MCP access is strictly read-only: queries are sandboxed (SELECT-only, bounded) and row-filtered to each key's scope, and rate-limited per key. An agent can investigate but can never change configuration or read outside its scope.

Which LLM providers are supported? Ollama (on-prem / air-gapped), Anthropic Claude, OpenAI (GPT-4o / GPT-4o-mini), Google Gemini, and any OpenAI-compatible endpoint (Azure, Groq, LM Studio, vLLM, Mistral, and others). You set a primary backend and an optional secondary (failover) that takes over automatically, plus a primary timeout. See LLM Configuration.

Does the AI send my logs to the cloud? Only if you choose a hosted model. Keel lets you run a local model (Ollama) for fully air-gapped AI, or plug in your own Anthropic/OpenAI/Gemini/OpenAI-compatible key. You own the model choice and the key. Even with a hosted model, only the context for a triggered request is sent — the log data plane never leaves the appliance.

Can it run air-gapped? Yes. Use a local LLM and an air-gapped license (annual, expiry-only, no activation call-home). No outbound connectivity is required.

What can it ingest? Logs via OpenTelemetry (OTLP), Syslog, and Fluentd; alerts from Alertmanager, Datadog, PagerDuty, and generic webhooks.

Where are logs stored, and how much can it hold? In a built-in column store on a dedicated log-storage disk you size to your retention needs. Aged data can tier to cheaper S3-compatible cold storage and remain queryable.

How does licensing work? Per-deployment, with tiered entitlements (ingest volume, AI RCA volume, node count, features). Connected licenses are node-locked and activate against the portal; air-gapped licenses validate offline by signature. See licensing.

Can I add more nodes / increase capacity? Yes — High Availability runs multiple nodes behind a floating VIP. Node count is governed by your license; contact support to adjust your entitlements.

How are updates delivered? As signed update bundles applied from Settings → Updates, component-by-component to minimize disruption. Config and log storage persist across updates.

Is there an API? Yes — the appliance exposes a REST API for ingest and configuration; the portal exposes the license/activation API the appliance consumes.

How do I get support? Through the customer portal Support area, or your account contact.