Overview
Platform Connect adds a cloud-connected capability layer to SolarWinds® Security Event Manager (SEM), bringing AI and ML-powered intelligence into the SEM experience without changing its on-premises deployment model.
Its initial value lies in anomaly detection and forecasting. This helps security teams move beyond static thresholds and fixed rules so they can spot unusual behavior faster, reduce noise, and focus on the events that are most likely to need investigation.
Strategically, Platform Connect bridges two customer needs: the control they already trust in SEM and the modern, AI-driven detection capabilities they increasingly expect.
Reference video
For a visual overview, see Security Event Manager | Anomalous Events Tech Preview:
This video demonstrates the Anomalous Events tech preview, explains requirements and access restrictions, and shows how Platform Connect is enabled and used in SEM 2026.2.
What this means
1. SEM remains on-premises by design
SEM continues to run as an on-premises appliance. Core functions, such as log collection, correlation rules, active response, and compliance reporting, remain on customer hardware.
Platform Connect is optional. If a customer chooses not to enable it, SEM works exactly as it does today and does not connect to any software as a service (SaaS) product.
2. The first innovation is AI-powered anomaly detection
The first major capability enabled by Platform Connect is anomaly detection, supported by forecasting.
The architecture uses a hybrid model. A SaaS forecasting service builds per-entity baselines, while anomaly detection runs locally on the SEM appliance using those baselines.
In practical terms, this helps customers get more intelligence from the data they already collect, with less manual tuning and better focus on the activity that matters most.
3. The value proposition is modernization without disruption
The core message is not that SEM is becoming a SaaS product. It is that SEM customers can access cloud-powered intelligence while keeping their preferred deployment model and operational control.
This gives SEM a path to modernization that aligns with market demand for AI-enhanced security analytics without pushing customers into a full cloud migration.
4. Trust and security are central to the story
Any cloud-connected AI story must begin with trust.
When Platform Connect is enabled, raw logs stay on the appliance. Only aggregated security metrics are sent, and hostnames and usernames are anonymized into internal IDs before leaving SEM.
This flow emphasizes consent, connection verification, and secure tenant linking.
5. Platform Connect also lays the groundwork for the future
Platform Connect matters for more than a single feature. It creates a connection layer that SEM can use to adopt additional SolarWinds Platform capabilities over time.
The immediate value starts with anomaly detection and forecasting. Over time, the bigger story is a more intelligent, more modern SEM experience that can continue to benefit from SolarWinds AI innovation.
A quick note for air-gapped environments
This initial phase relies on the SaaS service to build behavior baselines; it won't work in fully isolated or cloud-prohibited networks right away. You won't lose a single feature you rely on today, and fully offline, on-premises anomaly detection is absolutely planned for the future—even if a firm release window isn't set yet.
For teams that want stronger detection without disruptive change, Platform Connect is the bridge.
NOTE: Information regarding future features and functionality is not and should not be interpreted as a commitment from SolarWinds that it will deliver any specific feature or functionality in the future or, if it delivers such feature or functionality, any time frame when that feature or functionality will be delivered, how such feature or functionality will be licensed, or the specific outcomes that feature or functionality will deliver. SolarWinds undertakes no obligation to update these statements if product plans or priorities change.
