[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:log-management":3},{"control":4,"products":26,"stories":116,"lessons":160,"related":185,"compare":214},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":22,"updated_at":25},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.","A pipeline between your log sources and your security tools that filters, reduces and reshapes the data before anyone pays to store it. Noise is dropped or summarised, personal data is masked or pseudonymised, formats are standardised, and a full copy goes to low-cost storage. When an investigation needs older or dropped data, it can be searched where it lies or replayed into the SIEM.","SIEM bills grow with data volume, so many organisations either overspend or quietly stop collecting logs they cannot afford, and those are often exactly the logs an incident responder needs later. A pipeline cuts what reaches the expensive tools, especially from noisy sources such as firewalls and DNS, while keeping everything in cheap storage for the retention periods regulators expect. Masking personal data before it leaves its source supports GDPR data minimisation, and standard formats make it easier to change SIEM later without losing history. Judge it on detections kept, not only on volume saved: dropping the wrong field can blind a detection rule.",[11,12,13,14],"How much does it reduce our SIEM volume on our own data, and how do you show that no detection rule loses a field it needs?","Can archived data be searched in place or replayed into the SIEM, and how quickly?","How is personal data masked or pseudonymised, and can authorised investigators reverse it when needed?","What happens to our logs if the pipeline fails or falls behind: are they buffered or lost?","Risk: security logs that are missing, kept too briefly or unaffordable when an incident needs them, or that expose personal data. Control: a security data pipeline that filters and masks logs, sends a full copy to low-cost storage and can replay it into the SIEM. Owner: security operations lead. Measure: share of critical log sources collected and retained for the required period, and SIEM cost per gigabyte.",[17,18,19,20,21],"NIS2 Implementing Regulation (EU) 2024\u002F2690, Annex 3.2: monitoring and logging","DORA RTS (EU) 2024\u002F1774 Art. 12: logging procedures, protocols and tools","ISO\u002FIEC 27001:2022 A.8.15: logging","CIS Control 8: audit log management","GDPR Art. 5(1)(c): data minimisation",{"name":23,"slug":24},"Logging & Monitoring","logging-monitoring","2026-10-16T16:57:49.077343+00:00",[27,35,43,48,56,61,69,77,85,93,101,109],{"vendor_slug":28,"vendor_name":29,"vendor_logo":30,"product_slug":31,"product_name":32,"url":33,"description":34},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-pipelines","Abstract Pipelines","https:\u002F\u002Fwww.abstract.security\u002Fplatform\u002Fcollection","Collects security data from any source, normalises it in the pipeline and routes it to several destinations.",{"vendor_slug":36,"vendor_name":37,"vendor_logo":38,"product_slug":39,"product_name":40,"url":41,"description":42},"axoflow","Axoflow","\u002Fvendor-logos\u002Faxoflow.png","axolake","AxoLake","https:\u002F\u002Faxoflow.com\u002Faxolake-petabyte-security-data-storage","Data lake for security data in Parquet format, searchable in place without rehydration.",{"vendor_slug":36,"vendor_name":37,"vendor_logo":38,"product_slug":44,"product_name":45,"url":46,"description":47},"axorouter","AxoRouter","https:\u002F\u002Faxoflow.com\u002Faxorouter","Automates collection, curation and routing of security data, with built-in storage and search so data can be replayed or rehydrated into any tool.",{"vendor_slug":49,"vendor_name":50,"vendor_logo":51,"product_slug":52,"product_name":53,"url":54,"description":55},"cribl","Cribl","\u002Fvendor-logos\u002Fcribl.png","cribl-lake","Cribl Lake","https:\u002F\u002Fcribl.io\u002Fproducts\u002Flake\u002F","Managed data lake for IT and security telemetry in open formats, to store data cheaply and search or replay it later.",{"vendor_slug":49,"vendor_name":50,"vendor_logo":51,"product_slug":57,"product_name":58,"url":59,"description":60},"cribl-stream","Cribl Stream","https:\u002F\u002Fcribl.io\u002Fproducts\u002Fstream\u002F","Collects, reduces, redacts and routes data between sources and tools, keeps a full-fidelity copy in low-cost storage, and replays it when needed.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-onum","Falcon Onum","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-siem\u002Ffalcon-onum\u002F","Real-time telemetry pipeline from CrowdStrike's purchase of Onum. It filters and streams data into Falcon Next-Gen SIEM and can run detections on third-party data before it is stored.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"databahn","DataBahn","\u002Fvendor-logos\u002Fdatabahn.png","databahn-data-pipeline","DataBahn Data Pipeline","https:\u002F\u002Fwww.databahn.ai\u002Fproducts\u002Fdata-pipeline","Collection at the edge, transformation and routing of security data to SIEMs and data lakes, with an AI agent for managing the pipelines.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"edge-delta","Edge Delta","\u002Fvendor-logos\u002Fedge-delta.png","edge-delta-telemetry-pipelines","Telemetry Pipelines","https:\u002F\u002Fedgedelta.com\u002Fproduct\u002Ftelemetry-pipelines","Pipelines that process logs, metrics, traces and security events before they are indexed, with masking, hashing and pre-built packs, and a full-fidelity copy in object storage for rehydration.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"realm-security","Realm Security","\u002Fvendor-logos\u002Frealm-security.png","realm-security-data-pipeline","Realm Security Data Pipeline","https:\u002F\u002Frealm.security\u002F","Reduces, enriches and routes security data to SIEMs, data lakes and AI SOC tools, with a privacy guard that redacts fields and searchable retention that can resupply data later.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-transit","GreyMatter Transit","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Ftransit\u002F","Security data pipeline that normalises and routes telemetry and detects threats while the data is in motion, to cut lag and storage costs.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-ai-data-pipelines","Singularity AI Data Pipelines","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fdata-pipelines\u002F","Security data pipelines from SentinelOne's purchase of Observo AI: reduce noisy telemetry, convert data to OCSF and speed up SIEM migrations.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":111,"url":114,"description":115},"tenzir","Tenzir","\u002Fvendor-logos\u002Ftenzir.png","tenzir-platform","https:\u002F\u002Ftenzir.com\u002F","Pipelines that collect, shape, enrich and route security data, with an open-source core and free and commercial editions.",{"total":117,"last_days":118,"recent":119},40,35,[120,125,130,135,140,145,150,155],{"slug":121,"title":122,"published_at":123,"brief":124},"microsoft-365-crawls-back-to-life-after-a-24-hour-outage-6b7a92","Microsoft 365 Crawls Back to Life After a 24-Hour Outage","2026-11-13T19:08:57+00:00","Microsoft 365 outage affecting 70+ countries caused by bad network update, not cyberattack.",{"slug":126,"title":127,"published_at":128,"brief":129},"the-microsoft-outage-is-a-warning-for-the-world-aa3046","The Microsoft Outage Is a Warning for the World","2026-11-13T17:15:54+00:00","Microsoft 365 outage impacts Outlook, Teams, and Copilot globally for a second day.",{"slug":131,"title":132,"published_at":133,"brief":134},"microsoft-struggles-to-restore-email-and-other-services-in-a-global-outage-d96956","Microsoft Struggles to Restore Email and Other Services in a Global Outage","2026-11-13T13:47:42+00:00","Microsoft's global outage impacts Exchange Online, Outlook, Teams across multiple regions.",{"slug":136,"title":137,"published_at":138,"brief":139},"microsoft-365-massive-outage-fixes-fail-as-restored-servers-keep-going-unrespons-873bde","Microsoft 365 Massive Outage – Fixes Fail as Restored Servers Keep Going Unresponsive","2026-11-13T06:52:50+00:00","Microsoft 365 experiences a massive global outage as fixes fail to restore server stability.",{"slug":141,"title":142,"published_at":143,"brief":144},"hackers-hide-linux-backdoor-in-control-web-panel-server-to-execute-commands-with-97fd8d","Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs","2026-11-06T05:58:54+00:00","Hackers hide Linux backdoor in Control Web Panel server to execute commands without logs.",{"slug":146,"title":147,"published_at":148,"brief":149},"cyberattack-on-norway-s-aid-agency-may-have-swept-up-all-user-data-41a3eb","Cyberattack on Norway’s aid agency may have swept up all user data","2026-11-05T13:56:49+00:00","Norway's aid agency Norad discloses cyberattack potentially exposing data of 20,614 users.",{"slug":151,"title":152,"published_at":153,"brief":154},"hacktivists-leak-41-000-dhs-staff-records-revealing-undercover-ice-agents-fc010f","Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents","2026-10-29T10:16:18+00:00","Hacktivists leak 41,000 DHS employee records, including undercover ICE agents.",{"slug":156,"title":157,"published_at":158,"brief":159},"chinese-hackers-quietly-used-low-severity-esxi-logging-flaw-as-zero-day-6fa958","Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day","2026-10-29T08:01:05+00:00","Chinese hackers exploit VMware ESXi logging flaw as zero-day.",[161,165,169,173,177,181],{"slug":162,"title":163,"published_at":164},"microsoft-365-outage-exposes-risks-of-unvalidated-network-changes","Microsoft 365 Outage Exposes Risks of Unvalidated Network Changes","2026-11-13T20:20:57.119+00:00",{"slug":166,"title":167,"published_at":168},"microsoft-365-cascading-failure-exposes-risks-of-hyperscaler-dependency","Microsoft 365 Cascading Failure Exposes Risks of Hyperscaler Dependency","2026-11-13T18:20:58.32+00:00",{"slug":170,"title":171,"published_at":172},"faulty-update-triggers-global-microsoft-outage-echoing-crowdstrike-incident","Faulty Update Triggers Global Microsoft Outage, Echoing CrowdStrike Incident","2026-11-13T14:20:22.59+00:00",{"slug":174,"title":175,"published_at":176},"microsoft-365-global-outage-exposes-gaps-in-resilience-and-configuration-recovery","Microsoft 365 Global Outage Exposes Gaps in Resilience and Configuration Recovery","2026-11-13T08:21:35.526+00:00",{"slug":178,"title":179,"published_at":180},"linux-backdoor-in-cwp-server-evades-logs-via-root-access-abuse","Linux Backdoor in CWP Server Evades Logs via Root Access Abuse","2026-11-06T08:20:46.311+00:00",{"slug":182,"title":183,"published_at":184},"compromised-user-accounts-enable-mass-data-breach-at-norways-aid-agency","Compromised User Accounts Enable Mass Data Breach at Norway's Aid Agency","2026-11-05T14:20:47.149+00:00",[186,190,194,198,202,206,210],{"slug":187,"name":188,"problem":189},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":191,"name":192,"problem":193},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":195,"name":196,"problem":197},"soc-automation","SOC automation and AI analysts","Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.",{"slug":199,"name":200,"problem":201},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",{"slug":203,"name":204,"problem":205},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":207,"name":208,"problem":209},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",{"slug":211,"name":212,"problem":213},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"cribl\u002Fcribl-lake":215,"abstract-security\u002Fabstract-pipelines":229,"axoflow\u002Faxorouter":232,"edge-delta\u002Fedge-delta-telemetry-pipelines":239,"realm-security\u002Frealm-security-data-pipeline":242,"cribl\u002Fcribl-stream":245,"databahn\u002Fdatabahn-data-pipeline":251,"tenzir\u002Ftenzir-platform":257,"axoflow\u002Faxolake":261,"sentinelone\u002Fsingularity-ai-data-pipelines":265,"reliaquest\u002Fgreymatter-transit":278,"crowdstrike\u002Ffalcon-onum":286},{"hq_country":216,"also_provides":217,"reviews":218,"affected":228,"reported":228},"US",[],[219,222,225],{"label":220,"url":221},"Gartner Peer Insights: Cribl Stream user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fcribl-stream",{"label":223,"url":224},"PeerSpot: Cribl user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fcribl-reviews",{"label":226,"url":227},"TechTarget: Post-lawsuit, Splunk and Cribl meet again in data pipelines (2024)","https:\u002F\u002Fwww.techtarget.com\u002Fit-infrastructure\u002Fnews\u002F366589134\u002FPost-lawsuit-Splunk-and-Cribl-meet-again-in-data-pipelines",0,{"hq_country":216,"also_provides":230,"reviews":231,"affected":228,"reported":228},[],[],{"hq_country":233,"also_provides":234,"reviews":235,"affected":228,"reported":228},null,[],[236],{"label":237,"url":238},"Gartner Peer Insights: Axoflow user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Faxoflow-1",{"hq_country":216,"also_provides":240,"reviews":241,"affected":228,"reported":228},[],[],{"hq_country":216,"also_provides":243,"reviews":244,"affected":228,"reported":228},[],[],{"hq_country":216,"also_provides":246,"reviews":247,"affected":228,"reported":228},[],[248,249,250],{"label":220,"url":221},{"label":223,"url":224},{"label":226,"url":227},{"hq_country":216,"also_provides":252,"reviews":253,"affected":228,"reported":228},[],[254],{"label":255,"url":256},"Gartner Peer Insights: DataBahn user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fdatabahn",{"hq_country":258,"also_provides":259,"reviews":260,"affected":228,"reported":228},"DE",[],[],{"hq_country":233,"also_provides":262,"reviews":263,"affected":228,"reported":228},[],[264],{"label":237,"url":238},{"hq_country":216,"also_provides":266,"reviews":267,"affected":228,"reported":277},[],[268,271,274],{"label":269,"url":270},"Gartner Peer Insights: SentinelOne Singularity Endpoint user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fsentinelone-singularity-endpoint",{"label":272,"url":273},"PeerSpot: SentinelOne Singularity Endpoint user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fsentinelone-singularity-endpoint-reviews",{"label":275,"url":276},"TechTarget: SentinelOne vs. CrowdStrike: EPP tools for the enterprise (2025)","https:\u002F\u002Fwww.techtarget.com\u002Fcybersecurity\u002Ftip\u002FSentinelOne-vs-CrowdStrike-EPP-tools-for-the-enterprise",1,{"hq_country":216,"also_provides":279,"reviews":280,"affected":284,"reported":285},[],[281],{"label":282,"url":283},"Gartner Peer Insights: ReliaQuest GreyMatter user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Freliaquest-greymatter-314541335",3,4,{"hq_country":216,"also_provides":287,"reviews":288,"affected":285,"reported":301},[],[289,292,295,298],{"label":290,"url":291},"SE Labs enterprise endpoint test Apr-Jun 2026: CrowdStrike Falcon","https:\u002F\u002Fselabs.uk\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Fsecurity-evaluation-test-report-enterprise-crowdstrike-falcon-2026-07-factsheet.pdf",{"label":293,"url":294},"AV-Comparatives EPR test 2025: CrowdStrike Falcon Enterprise","https:\u002F\u002Fwww.av-comparatives.org\u002Fwp-content\u002Fuploads\u002F2025\u002F09\u002FEPR_CrowdStrike_2025.pdf",{"label":296,"url":297},"Gartner Peer Insights: CrowdStrike Falcon user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fcrowdstrike-falcon",{"label":299,"url":300},"PeerSpot: CrowdStrike Falcon user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fcrowdstrike-falcon-reviews",23]