[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:log-management":3},{"control":4,"products":26,"stories":116,"lessons":160,"related":185,"compare":214},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":22,"updated_at":25},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.","A pipeline between your log sources and your security tools that filters, reduces and reshapes the data before anyone pays to store it. Noise is dropped or summarised, personal data is masked or pseudonymised, formats are standardised, and a full copy goes to low-cost storage. When an investigation needs older or dropped data, it can be searched where it lies or replayed into the SIEM.","SIEM bills grow with data volume, so many organisations either overspend or quietly stop collecting logs they cannot afford, and those are often exactly the logs an incident responder needs later. A pipeline cuts what reaches the expensive tools, especially from noisy sources such as firewalls and DNS, while keeping everything in cheap storage for the retention periods regulators expect. Masking personal data before it leaves its source supports GDPR data minimisation, and standard formats make it easier to change SIEM later without losing history. Judge it on detections kept, not only on volume saved: dropping the wrong field can blind a detection rule.",[11,12,13,14],"How much does it reduce our SIEM volume on our own data, and how do you show that no detection rule loses a field it needs?","Can archived data be searched in place or replayed into the SIEM, and how quickly?","How is personal data masked or pseudonymised, and can authorised investigators reverse it when needed?","What happens to our logs if the pipeline fails or falls behind: are they buffered or lost?","Risk: security logs that are missing, kept too briefly or unaffordable when an incident needs them, or that expose personal data. Control: a security data pipeline that filters and masks logs, sends a full copy to low-cost storage and can replay it into the SIEM. Owner: security operations lead. Measure: share of critical log sources collected and retained for the required period, and SIEM cost per gigabyte.",[17,18,19,20,21],"NIS2 Implementing Regulation (EU) 2024\u002F2690, Annex 3.2: monitoring and logging","DORA RTS (EU) 2024\u002F1774 Art. 12: logging procedures, protocols and tools","ISO\u002FIEC 27001:2022 A.8.15: logging","CIS Control 8: audit log management","GDPR Art. 5(1)(c): data minimisation",{"name":23,"slug":24},"Logging & Monitoring","logging-monitoring","2026-10-16T16:57:49.077343+00:00",[27,35,43,48,56,61,69,77,85,93,101,109],{"vendor_slug":28,"vendor_name":29,"vendor_logo":30,"product_slug":31,"product_name":32,"url":33,"description":34},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-pipelines","Abstract Pipelines","https:\u002F\u002Fwww.abstract.security\u002Fplatform\u002Fcollection","Collects security data from any source, normalises it in the pipeline and routes it to several destinations.",{"vendor_slug":36,"vendor_name":37,"vendor_logo":38,"product_slug":39,"product_name":40,"url":41,"description":42},"axoflow","Axoflow","\u002Fvendor-logos\u002Faxoflow.png","axolake","AxoLake","https:\u002F\u002Faxoflow.com\u002Faxolake-petabyte-security-data-storage","Data lake for security data in Parquet format, searchable in place without rehydration.",{"vendor_slug":36,"vendor_name":37,"vendor_logo":38,"product_slug":44,"product_name":45,"url":46,"description":47},"axorouter","AxoRouter","https:\u002F\u002Faxoflow.com\u002Faxorouter","Automates collection, curation and routing of security data, with built-in storage and search so data can be replayed or rehydrated into any tool.",{"vendor_slug":49,"vendor_name":50,"vendor_logo":51,"product_slug":52,"product_name":53,"url":54,"description":55},"cribl","Cribl","\u002Fvendor-logos\u002Fcribl.png","cribl-lake","Cribl Lake","https:\u002F\u002Fcribl.io\u002Fproducts\u002Flake\u002F","Managed data lake for IT and security telemetry in open formats, to store data cheaply and search or replay it later.",{"vendor_slug":49,"vendor_name":50,"vendor_logo":51,"product_slug":57,"product_name":58,"url":59,"description":60},"cribl-stream","Cribl Stream","https:\u002F\u002Fcribl.io\u002Fproducts\u002Fstream\u002F","Collects, reduces, redacts and routes data between sources and tools, keeps a full-fidelity copy in low-cost storage, and replays it when needed.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-onum","Falcon Onum","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-siem\u002Ffalcon-onum\u002F","Real-time telemetry pipeline from CrowdStrike's purchase of Onum. It filters and streams data into Falcon Next-Gen SIEM and can run detections on third-party data before it is stored.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"databahn","DataBahn","\u002Fvendor-logos\u002Fdatabahn.png","databahn-data-pipeline","DataBahn Data Pipeline","https:\u002F\u002Fwww.databahn.ai\u002Fproducts\u002Fdata-pipeline","Collection at the edge, transformation and routing of security data to SIEMs and data lakes, with an AI agent for managing the pipelines.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"edge-delta","Edge Delta","\u002Fvendor-logos\u002Fedge-delta.png","edge-delta-telemetry-pipelines","Telemetry Pipelines","https:\u002F\u002Fedgedelta.com\u002Fproduct\u002Ftelemetry-pipelines","Pipelines that process logs, metrics, traces and security events before they are indexed, with masking, hashing and pre-built packs, and a full-fidelity copy in object storage for rehydration.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"realm-security","Realm Security","\u002Fvendor-logos\u002Frealm-security.png","realm-security-data-pipeline","Realm Security Data Pipeline","https:\u002F\u002Frealm.security\u002F","Reduces, enriches and routes security data to SIEMs, data lakes and AI SOC tools, with a privacy guard that redacts fields and searchable retention that can resupply data later.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-transit","GreyMatter Transit","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Ftransit\u002F","Security data pipeline that normalises and routes telemetry and detects threats while the data is in motion, to cut lag and storage costs.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-ai-data-pipelines","Singularity AI Data Pipelines","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fdata-pipelines\u002F","Security data pipelines from SentinelOne's purchase of Observo AI: reduce noisy telemetry, convert data to OCSF and speed up SIEM migrations.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":111,"url":114,"description":115},"tenzir","Tenzir","\u002Fvendor-logos\u002Ftenzir.png","tenzir-platform","https:\u002F\u002Ftenzir.com\u002F","Pipelines that collect, shape, enrich and route security data, with an open-source core and free and commercial editions.",{"total":117,"last_days":118,"recent":119},23,22,[120,125,130,135,140,145,150,155],{"slug":121,"title":122,"published_at":123,"brief":124},"openai-models-hacked-data-portals-raided-a-crypto-wallet-to-finish-tasks-adc238","OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks","2026-10-16T10:32:11+00:00","OpenAI models accessed live systems, bypassed authorization, and stole data.",{"slug":126,"title":127,"published_at":128,"brief":129},"no-edr-no-problem-how-huntress-rebuilt-an-akira-ransomware-attack-from-forensic--944524","No EDR, no problem: how Huntress rebuilt an Akira ransomware attack from forensic leftovers","2026-10-08T10:13:47+00:00","Huntress reconstructs Akira ransomware attack using forensic data without EDR telemetry.",{"slug":131,"title":132,"published_at":133,"brief":134},"cisa-adds-exploited-cisco-catalyst-sd-wan-manager-auth-bypass-to-kev-346b23","CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV","2026-10-01T10:33:16+00:00","CISA adds critical Cisco Catalyst SD-WAN Manager auth bypass (CVE-2026-76504) to KEV list due to active exploitation.",{"slug":136,"title":137,"published_at":138,"brief":139},"arista-patches-actively-exploited-velocloud-orchestrator-zero-day-a0cbe8","Arista patches actively exploited VeloCloud Orchestrator zero-day","2026-09-23T12:29:53+00:00","Arista patches actively exploited VeloCloud Orchestrator zero-day (CVE-2026-93952).",{"slug":141,"title":142,"published_at":143,"brief":144},"aepd-spain-exp202406239-32448c","AEPD (Spain) - EXP202406239","2026-09-16T07:29:58+00:00","Spain's AEPD upholds €1M GDPR fine against an energy company for inadequate call center identity verification.",{"slug":146,"title":147,"published_at":148,"brief":149},"garante-per-la-protezione-dei-dati-personali-italy-616-2026-6a036a","Garante per la protezione dei dati personali (Italy) - 616\u002F2026","2026-09-15T14:23:55+00:00","Italian DPA fines University Health Agency for improper access to patient records.",{"slug":151,"title":152,"published_at":153,"brief":154},"cisco-secure-email-gateway-flaw-exploited-in-the-wild-enables-root-command-execu-afc835","Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution","2026-09-15T06:11:11+00:00","Cisco Secure Email Gateway flaw exploited in the wild, enabling root command execution.",{"slug":156,"title":157,"published_at":158,"brief":159},"n-able-patches-critical-zero-day-in-n-central-f20f3d","N-able Patches Critical Zero-Day in N-central","2026-09-08T10:37:58+00:00","N-able patches critical zero-day RCE vulnerability in N-central endpoint management platform.",[161,165,169,173,177,181],{"slug":162,"title":163,"published_at":164},"ai-models-act-autonomously-to-bypass-auth-and-raid-crypto-wallets","AI Models Act Autonomously to Bypass Auth and Raid Crypto Wallets","2026-10-16T12:21:09.736+00:00",{"slug":166,"title":167,"published_at":168},"akira-ransomware-reconstructed-from-forensic-crumbs-after-edr-gap","Akira Ransomware Reconstructed from Forensic Crumbs After EDR Gap","2026-10-08T12:21:27.762+00:00",{"slug":170,"title":171,"published_at":172},"critical-cisco-sd-wan-auth-bypass-exploited-in-the-wild-1790857283100","Critical Cisco SD-WAN Auth Bypass Exploited in the Wild","2026-10-01T12:21:22.632+00:00",{"slug":174,"title":175,"published_at":176},"arista-velocloud-zero-day-exploited-before-patch-available","Arista VeloCloud Zero-Day Exploited Before Patch Available","2026-09-23T19:20:41.873+00:00",{"slug":178,"title":179,"published_at":180},"1m-gdpr-fine-for-weak-call-center-identity-verification","€1M GDPR Fine for Weak Call Center Identity Verification","2026-09-16T08:22:39.767+00:00",{"slug":182,"title":183,"published_at":184},"italian-dpa-finds-hospital-exposed-patient-records-through-weak-access-controls-and-logging","Italian DPA Finds Hospital Exposed Patient Records Through Weak Access Controls and Logging","2026-09-15T17:20:28.888+00:00",[186,190,194,198,202,206,210],{"slug":187,"name":188,"problem":189},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":191,"name":192,"problem":193},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":195,"name":196,"problem":197},"soc-automation","SOC automation and AI analysts","Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.",{"slug":199,"name":200,"problem":201},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",{"slug":203,"name":204,"problem":205},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":207,"name":208,"problem":209},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",{"slug":211,"name":212,"problem":213},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"cribl\u002Fcribl-lake":215,"abstract-security\u002Fabstract-pipelines":229,"axoflow\u002Faxorouter":232,"edge-delta\u002Fedge-delta-telemetry-pipelines":239,"realm-security\u002Frealm-security-data-pipeline":242,"cribl\u002Fcribl-stream":245,"databahn\u002Fdatabahn-data-pipeline":251,"tenzir\u002Ftenzir-platform":257,"axoflow\u002Faxolake":261,"sentinelone\u002Fsingularity-ai-data-pipelines":265,"reliaquest\u002Fgreymatter-transit":278,"crowdstrike\u002Ffalcon-onum":286},{"hq_country":216,"also_provides":217,"reviews":218,"affected":228,"reported":228},"US",[],[219,222,225],{"label":220,"url":221},"Gartner Peer Insights: Cribl Stream user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fcribl-stream",{"label":223,"url":224},"PeerSpot: Cribl user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fcribl-reviews",{"label":226,"url":227},"TechTarget: Post-lawsuit, Splunk and Cribl meet again in data pipelines (2024)","https:\u002F\u002Fwww.techtarget.com\u002Fit-infrastructure\u002Fnews\u002F366589134\u002FPost-lawsuit-Splunk-and-Cribl-meet-again-in-data-pipelines",0,{"hq_country":216,"also_provides":230,"reviews":231,"affected":228,"reported":228},[],[],{"hq_country":233,"also_provides":234,"reviews":235,"affected":228,"reported":228},null,[],[236],{"label":237,"url":238},"Gartner Peer Insights: Axoflow user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Faxoflow-1",{"hq_country":216,"also_provides":240,"reviews":241,"affected":228,"reported":228},[],[],{"hq_country":216,"also_provides":243,"reviews":244,"affected":228,"reported":228},[],[],{"hq_country":216,"also_provides":246,"reviews":247,"affected":228,"reported":228},[],[248,249,250],{"label":220,"url":221},{"label":223,"url":224},{"label":226,"url":227},{"hq_country":216,"also_provides":252,"reviews":253,"affected":228,"reported":228},[],[254],{"label":255,"url":256},"Gartner Peer Insights: DataBahn user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fdatabahn",{"hq_country":258,"also_provides":259,"reviews":260,"affected":228,"reported":228},"DE",[],[],{"hq_country":233,"also_provides":262,"reviews":263,"affected":228,"reported":228},[],[264],{"label":237,"url":238},{"hq_country":216,"also_provides":266,"reviews":267,"affected":228,"reported":277},[],[268,271,274],{"label":269,"url":270},"Gartner Peer Insights: SentinelOne Singularity Endpoint user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fsentinelone-singularity-endpoint",{"label":272,"url":273},"PeerSpot: SentinelOne Singularity Endpoint user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fsentinelone-singularity-endpoint-reviews",{"label":275,"url":276},"TechTarget: SentinelOne vs. CrowdStrike: EPP tools for the enterprise (2025)","https:\u002F\u002Fwww.techtarget.com\u002Fcybersecurity\u002Ftip\u002FSentinelOne-vs-CrowdStrike-EPP-tools-for-the-enterprise",2,{"hq_country":216,"also_provides":279,"reviews":280,"affected":284,"reported":285},[],[281],{"label":282,"url":283},"Gartner Peer Insights: ReliaQuest GreyMatter user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Freliaquest-greymatter-314541335",3,8,{"hq_country":216,"also_provides":287,"reviews":288,"affected":301,"reported":302},[],[289,292,295,298],{"label":290,"url":291},"SE Labs enterprise endpoint test Apr-Jun 2026: CrowdStrike Falcon","https:\u002F\u002Fselabs.uk\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Fsecurity-evaluation-test-report-enterprise-crowdstrike-falcon-2026-07-factsheet.pdf",{"label":293,"url":294},"AV-Comparatives EPR test 2025: CrowdStrike Falcon Enterprise","https:\u002F\u002Fwww.av-comparatives.org\u002Fwp-content\u002Fuploads\u002F2025\u002F09\u002FEPR_CrowdStrike_2025.pdf",{"label":296,"url":297},"Gartner Peer Insights: CrowdStrike Falcon user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fcrowdstrike-falcon",{"label":299,"url":300},"PeerSpot: CrowdStrike Falcon user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fcrowdstrike-falcon-reviews",4,15]