Abstract Pipelines
Collects security data from any source, normalises it in the pipeline and routes it to several destinations.
Logging & Monitoring
Log management and security data pipelines
Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.
Addresses 32 stories in our coverage in the last 90 days 12 products that provide it
What it is
A pipeline between your log sources and your security tools that filters, reduces and reshapes the data before anyone pays to store it. Noise is dropped or summarised, personal data is masked or pseudonymised, formats are standardised, and a full copy goes to low-cost storage. When an investigation needs older or dropped data, it can be searched where it lies or replayed into the SIEM.
How to value it
SIEM bills grow with data volume, so many organisations either overspend or quietly stop collecting logs they cannot afford, and those are often exactly the logs an incident responder needs later. A pipeline cuts what reaches the expensive tools, especially from noisy sources such as firewalls and DNS, while keeping everything in cheap storage for the retention periods regulators expect. Masking personal data before it leaves its source supports GDPR data minimisation, and standard formats make it easier to change SIEM later without losing history. Judge it on detections kept, not only on volume saved: dropping the wrong field can blind a detection rule.
Questions to ask a vendor
- 1How much does it reduce our SIEM volume on our own data, and how do you show that no detection rule loses a field it needs?
- 2Can archived data be searched in place or replayed into the SIEM, and how quickly?
- 3How is personal data masked or pseudonymised, and can authorised investigators reverse it when needed?
- 4What happens to our logs if the pipeline fails or falls behind: are they buffered or lost?
For your risk register
- Risk
- Security logs that are missing, kept too briefly or unaffordable when an incident needs them, or that expose personal data.
- Control
- A security data pipeline that filters and masks logs, sends a full copy to low-cost storage and can replay it into the SIEM.
- Owner
- Security operations lead.
- Measure
- Share of critical log sources collected and retained for the required period, and SIEM cost per gigabyte.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
AxoLake
Data lake for security data in Parquet format, searchable in place without rehydration.
AxoRouter
Automates collection, curation and routing of security data, with built-in storage and search so data can be replayed or rehydrated into any tool.
Cribl Lake
Managed data lake for IT and security telemetry in open formats, to store data cheaply and search or replay it later.
Cribl Stream
Collects, reduces, redacts and routes data between sources and tools, keeps a full-fidelity copy in low-cost storage, and replays it when needed.
Falcon Onum
Real-time telemetry pipeline from CrowdStrike's purchase of Onum. It filters and streams data into Falcon Next-Gen SIEM and can run detections on third-party data before it is stored.
DataBahn Data Pipeline
Collection at the edge, transformation and routing of security data to SIEMs and data lakes, with an AI agent for managing the pipelines.
Telemetry Pipelines
Pipelines that process logs, metrics, traces and security events before they are indexed, with masking, hashing and pre-built packs, and a full-fidelity copy in object storage for rehydration.
Realm Security Data Pipeline
Reduces, enriches and routes security data to SIEMs, data lakes and AI SOC tools, with a privacy guard that redacts fields and searchable retention that can resupply data later.
GreyMatter Transit
Security data pipeline that normalises and routes telemetry and detects threats while the data is in motion, to cut lag and storage costs.
Singularity AI Data Pipelines
Security data pipelines from SentinelOne's purchase of Observo AI: reduce noisy telemetry, convert data to OCSF and speed up SIEM migrations.
Tenzir
Pipelines that collect, shape, enrich and route security data, with an open-source core and free and commercial editions.
Recent stories it addresses
37 stories in total- 13 Nov 2026Microsoft 365 Massive Outage – Fixes Fail as Restored Servers Keep Going Unresponsive
Microsoft 365 experiences a massive global outage as fixes fail to restore server stability.
- 6 Nov 2026Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs
Hackers hide Linux backdoor in Control Web Panel server to execute commands without logs.
- 5 Nov 2026Cyberattack on Norway’s aid agency may have swept up all user data
Norway's aid agency Norad discloses cyberattack potentially exposing data of 20,614 users.
- 29 Oct 2026Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents
Hacktivists leak 41,000 DHS employee records, including undercover ICE agents.
- 29 Oct 2026Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Chinese hackers exploit VMware ESXi logging flaw as zero-day.
- 29 Oct 2026CISA Warns of VMWare ESX Logging Vulnerability Exploited in Attacks
CISA adds VMware ESX logging flaw CVE-2026-41709 to KEV due to exploitation.
- 29 Oct 2026China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
China-linked hackers exploit VMware ESX zero-day, CVE-2026-41709, targeting US legal sector.
- 28 Oct 2026Data breach at Sony-owned internet provider compromises 2.6 million customer records
Sony-owned ISP So-net suffers data breach, exposing 2.6 million customer records and email passwords.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.