Abstract Pipelines
Collects security data from any source, normalises it in the pipeline and routes it to several destinations.
Logging & Monitoring
Log management and security data pipelines
Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.
Addresses 22 stories in our coverage in the last 90 days 12 products that provide it
What it is
A pipeline between your log sources and your security tools that filters, reduces and reshapes the data before anyone pays to store it. Noise is dropped or summarised, personal data is masked or pseudonymised, formats are standardised, and a full copy goes to low-cost storage. When an investigation needs older or dropped data, it can be searched where it lies or replayed into the SIEM.
How to value it
SIEM bills grow with data volume, so many organisations either overspend or quietly stop collecting logs they cannot afford, and those are often exactly the logs an incident responder needs later. A pipeline cuts what reaches the expensive tools, especially from noisy sources such as firewalls and DNS, while keeping everything in cheap storage for the retention periods regulators expect. Masking personal data before it leaves its source supports GDPR data minimisation, and standard formats make it easier to change SIEM later without losing history. Judge it on detections kept, not only on volume saved: dropping the wrong field can blind a detection rule.
Questions to ask a vendor
- 1How much does it reduce our SIEM volume on our own data, and how do you show that no detection rule loses a field it needs?
- 2Can archived data be searched in place or replayed into the SIEM, and how quickly?
- 3How is personal data masked or pseudonymised, and can authorised investigators reverse it when needed?
- 4What happens to our logs if the pipeline fails or falls behind: are they buffered or lost?
For your risk register
- Risk
- Security logs that are missing, kept too briefly or unaffordable when an incident needs them, or that expose personal data.
- Control
- A security data pipeline that filters and masks logs, sends a full copy to low-cost storage and can replay it into the SIEM.
- Owner
- Security operations lead.
- Measure
- Share of critical log sources collected and retained for the required period, and SIEM cost per gigabyte.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
AxoLake
Data lake for security data in Parquet format, searchable in place without rehydration.
AxoRouter
Automates collection, curation and routing of security data, with built-in storage and search so data can be replayed or rehydrated into any tool.
Cribl Lake
Managed data lake for IT and security telemetry in open formats, to store data cheaply and search or replay it later.
Cribl Stream
Collects, reduces, redacts and routes data between sources and tools, keeps a full-fidelity copy in low-cost storage, and replays it when needed.
Falcon Onum
Real-time telemetry pipeline from CrowdStrike's purchase of Onum. It filters and streams data into Falcon Next-Gen SIEM and can run detections on third-party data before it is stored.
DataBahn Data Pipeline
Collection at the edge, transformation and routing of security data to SIEMs and data lakes, with an AI agent for managing the pipelines.
Telemetry Pipelines
Pipelines that process logs, metrics, traces and security events before they are indexed, with masking, hashing and pre-built packs, and a full-fidelity copy in object storage for rehydration.
Realm Security Data Pipeline
Reduces, enriches and routes security data to SIEMs, data lakes and AI SOC tools, with a privacy guard that redacts fields and searchable retention that can resupply data later.
GreyMatter Transit
Security data pipeline that normalises and routes telemetry and detects threats while the data is in motion, to cut lag and storage costs.
Singularity AI Data Pipelines
Security data pipelines from SentinelOne's purchase of Observo AI: reduce noisy telemetry, convert data to OCSF and speed up SIEM migrations.
Tenzir
Pipelines that collect, shape, enrich and route security data, with an open-source core and free and commercial editions.
Recent stories it addresses
23 stories in total- 16 Oct 2026OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks
OpenAI models accessed live systems, bypassed authorization, and stole data.
- 8 Oct 2026No EDR, no problem: how Huntress rebuilt an Akira ransomware attack from forensic leftovers
Huntress reconstructs Akira ransomware attack using forensic data without EDR telemetry.
- 1 Oct 2026CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
CISA adds critical Cisco Catalyst SD-WAN Manager auth bypass (CVE-2026-76504) to KEV list due to active exploitation.
- 23 Sept 2026Arista patches actively exploited VeloCloud Orchestrator zero-day
Arista patches actively exploited VeloCloud Orchestrator zero-day (CVE-2026-93952).
- 16 Sept 2026AEPD (Spain) - EXP202406239
Spain's AEPD upholds €1M GDPR fine against an energy company for inadequate call center identity verification.
- 15 Sept 2026Garante per la protezione dei dati personali (Italy) - 616/2026
Italian DPA fines University Health Agency for improper access to patient records.
- 15 Sept 2026Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution
Cisco Secure Email Gateway flaw exploited in the wild, enabling root command execution.
- 8 Sept 2026N-able Patches Critical Zero-Day in N-central
N-able patches critical zero-day RCE vulnerability in N-central endpoint management platform.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.