Command
your security data

The agentic telemetry pipeline for data-driven cyber defenders.

Book a demo Start for free

The pipeline

Turn intent into deployable pipelines

Describe the outcome: onboard your events, make them OCSF-compliant, and remove the noise. Your agent turns that intent into a deployable pipeline.

Hyperscaler

On-prem · self-hosted

SaaS

latencythroughputreduction

SIEM budget

/ $$/GB

SIEM · SOAR · XDR

Data lake

›

Explore agent skills

Building blocks

Compose your security data pipelines

Let your agents collect, transform, and route all data by assembling prebuilt operators into pipelines you can read at a glance.

CollectParseNormalizeShapeOptimizeAnonymizeEnrichAggregateDetectStoreSearchRouteReplay

Collect

Fetch paginated API results over HTTP, follow the cursor links, unpack the response envelope, and publish what arrives for the next pipeline.

Read the docs

TQL

let $url = "https://api.example.com/security/events"
let $headers = {
  "Authorization": f"Bearer {secret("EVENTS_TOKEN")}",
}
from_http f"{$url}?limit=500",
  headers=$headers,
  paginate=(page => {
    url: f"{$url}?limit=500&cursor={page.next_cursor}",
  } if page.next_cursor != null),
  paginate_delay=250ms,
  max_retry_count=5 {
  read_json
}
unroll events
this = events
ingest = {source: "events-api", received_at: now()}
publish "events.raw"

Parse

Receive Syslog over UDP and turn the message body into typed fields with key-value and request-line parsing.

Read the docs

TQL

accept_udp "0.0.0.0:514"
syslog = data.parse_syslog()
fields = syslog.message.trim().parse_kv(unflatten_separator=".")
fields.http.request = fields.http.request.parse_ssv(
  header=["method", "url", "version"],
)
fields.src.ip = ip(fields.src.ip)
fields.dst.ip = ip(fields.dst.ip)
fields.src.port = int(fields.src.port)
fields.dst.port = int(fields.dst.port)
this = {
  timestamp: syslog.timestamp,
  hostname: syslog.hostname,
  app: syslog.app_name,
  ...fields,
}

Normalize

Map vendor fields into OCSF, ASIM, ECS, CIM, UDM, or your own schema, and keep whatever has no home yet. Every downstream tool then sees the same semantics.

Read the docs

TQL

unmapped = this
@name = "ocsf.network_activity"
metadata = {
  version: "1.9.0",
  product: {name: "PAN-OS", vendor_name: "Palo Alto Networks"},
}
category_uid = 4
class_uid = 4001
activity_id = 6
severity_id = 1
type_uid = class_uid * 100 + activity_id
time = move timestamp
src_endpoint = {ip: move src.ip, port: move src.port}
dst_endpoint = {ip: move dst.ip, port: move dst.port}
connection_info.protocol_name = (move proto).to_lower()
ocsf_derive
ocsf_cast

Shape

Restructure events without changing what they mean. Spread records and lists, round timestamps, test subnet membership, derive totals, and sort tags.

Read the docs

TQL

let $corp = 10.0.0.0/8
timestamp = timestamp.round(1s)
duration = duration.round(1ms)
client = {
  ...client,
  internal: client.ip in $corp,
}
server = {
  ...server,
  internal: server.ip in $corp,
}
request.path = request.url.split("?")[0]
totals = {
  bytes: bytes_in + bytes_out,
  packets: packets_in + packets_out,
}
tags = [...tags?, request.method.to_lower()].sort()
drop bytes_in, bytes_out, packets_in, packets_out

Optimize

Drop what nobody queries and collapse repeats while the data is still in flight, so storage cost and analyst noise stay down.

Read the docs

TQL

where class_uid == 4001 and activity_id == 6
severity_id = severity_id? else 1
deduplicate src_endpoint.ip, dst_endpoint.ip,
  connection_info.protocol_name,
  create_timeout=1h,
  count_field=suppressed
where severity_id >= 4 or suppressed > 10

Anonymize

Protect sensitive fields with IP anonymization, email masking, salted hashes, partial reveals, redaction, and drops. Keep useful correlations without raw identities.

Read the docs

TQL

let $ip_seed = env("CRYPTOPAN_SEED")
let $hash_salt = env("HASH_SALT")
src_endpoint.ip = encrypt_cryptopan(src_endpoint.ip, seed=$ip_seed)
user.email_addr = f"*****@{user.email_addr.split("@")[1]}"
user.uid = user.uid.hash_sha256(seed=$hash_salt)
card_number = card_number.slice(begin=-4).pad_start(16, "*")
unmapped.dob = unmapped.dob.format_time("%Y-01-01").time()
unmapped.api_key = "******"
drop unmapped.password, unmapped.token

Enrich

Add domain reputation and asset inventory from live lookup tables, then ask a local model to summarize what came back.

Read the docs

TQL

where class_uid == 4003
// Lookup tables add reputation and asset context.
context_enrich "domain_reputation",
  key=query.hostname,
  into=observables,
  mode="append"
context_enrich "endpoint_assets",
  key=src_endpoint.ip,
  into=src_endpoint
// GLM5.2 runs on local Ollama.
ai_prompt model="GLM5.2",
  endpoint="http://127.0.0.1:11434/v1",
  system="Summarize this enriched DNS event.",
  data={
    query: query.hostname,
    reputation: observables,
    asset: src_endpoint,
  },
  into=ai.summary

Aggregate

Turn a stream of events into statements about it. Hopping event-time windows produce rolling top talkers with byte, flow, and peer counts.

Read the docs

TQL

where class_uid == 4001
window size=1h, every=10min, on=time {
  summarize src=src_endpoint.ip,
    bytes=sum(traffic.bytes),
    flows=count(),
    peers=count_distinct(dst_endpoint.ip)
  sort -bytes
  head 10
  window_start = $window.start
}
publish "ocsf.top-talkers"

Detect

Spot SMB traffic spikes with event-time windows and a statistical baseline, while the events are still moving.

Read the docs

TQL

where class_uid == 4006 and traffic.bytes? != null
window size=70min, every=10min, on=time {
  summarize src=src_endpoint.hostname, samples=count(),
    avg_bytes=mean(traffic.bytes),
    stdev_bytes=stddev(traffic.bytes),
    current_bytes=max(traffic.bytes)
  upper_bound = avg_bytes + stdev_bytes * 2
  where samples >= 5 and current_bytes > upper_bound
  start = $window.start
  end = $window.end
}

Store

Persist columnar security data in object storage. Compression, rotation, and partitioning keep the lake predictable and cheap to query.

Read the docs

TQL

where class_uid == 4001
year = time.year()
month = time.month()
day = time.day()
to_s3 "s3://security-lake/ocsf/network/**/data_{uuid}.parquet",
  partition_by=[class_uid, metadata.product.name,
    year, month, day],
  max_size=128M {
  write_parquet compression_type="zstd"
}

Search

Query events you already stored, wherever they live. ClickHouse filters, sorts, and limits before Tenzir reads a single row.

Read the docs

TQL

from_clickhouse uri="clickhouse://clickhouse:9000/security", sql=r#"
  SELECT time, src_endpoint, dst_endpoint, traffic, severity_id
  FROM network_activity
  WHERE time >= now() - INTERVAL 24 HOUR
    AND severity_id >= 4
  ORDER BY time DESC
  LIMIT 100
"#
where src_endpoint.ip in 10.0.0.0/8

Route

Split, publish, fork, and load-balance streams to the right destinations. Send alerts, archives, and SIEM feeds without duplicating collection work.

Read the docs

TQL

let $splunk = [
  {url: "https://splunk-a:8088", token: secret("HEC_A")},
  {url: "https://splunk-b:8088", token: secret("HEC_B")},
]
subscribe "ocsf.normalized"
fork {
  where severity_id >= 4
  publish "ocsf.alerts.high"
}
load_balance $splunk {
  to_splunk $splunk.url, hec_token=$splunk.token
}

Replay

Send stored events back to the start of the pipeline with shifted timestamps. Recreate an incident at real speed or twenty times faster, against detections you just changed.

Read the docs

TQL

from_file "s3://security-lake/ocsf/network/**/day=17/*.parquet" {
  read_parquet
}
where time >= 2024-01-17T09:00:00Z and time < 2024-01-17T10:00:00Z
sort time
timeshift time, start=now()
delay time, speed=20.0
publish "ocsf.replay"

Integrations

Connect the world of security and data

All security data at your fingertips. Unlock its value with our expanding list of integrations.

View all integrations

Latest resources

Fresh insights for security data teams

Blog Post

Aug 18, 2026

Don't rip out rsyslog. Point it at Tenzir.

Keep the rsyslog collectors, queues, and retries you already operate, change only where they ship to, and turn reliable Syslog delivery into structured security data with native RELP support in Tenzir.

Blog Post

Aug 14, 2026

Programmable aggregation: one model for streams, windows, and events

One aggregation model covers stats, streamstats, eventstats, and programmable windows by separating boundaries, state, and output.

Blog Post

Aug 12, 2026

Per-asset baselines for detection over streaming OCSF

Learn per-asset baselines from stored OCSF Network Activity on a schedule, publish them as lookup tables, and judge the live stream with robust statistics.

Explore all resources

Customer voices

Why security teams choose Tenzir

Tenzir gave us a security data lake that runs entirely inside our own AWS VPC. We normalize logs into open formats in S3 and query terabytes of history at low cost, with no SIEM lock-in. Privacy is the foundation of everything we build, and that principle doesn't stop at our own telemetry.

Ashley Blackmore

Security Engineer, Cape

Tenzir empowered us to create a federated security operations architecture that allows us to focus on content and people instead of technology. This has provided our organization with the necessary capability and flexibility to support new features, growth, and expansion.

Dr. Andreas Rohr

Managing Director, DCSO

At G+D, our telemetry was bound to the tools that consumed it, so every architectural decision was dictated by a vendor's ingestion model. Tenzir decoupled the two. We now govern every data flow across our infrastructure from one place, independent of any platform downstream. That organizational control is the real value, and cost discipline is its direct result: we decide which telemetry is worth keeping, so we pay for the volume we choose rather than the volume we inherit.

Thorsten Delbrouck

Chief Security Officer, Giesecke+Devrient

As an MDR provider defending European organizations against advanced adversaries, our assume-breach mindset requires broad and deep security telemetry—not just to detect threats, but to investigate incidents and understand root cause. The challenge is that ingesting everything into the detection tier quickly becomes economically unsustainable. Tenzir lets us keep the visibility we need while controlling cost, scaling efficiently, and keeping analysts focused on what matters.

Joost Bijl

Head of Product, Hunt & Hackett

Built for the agentic era

One data pipeline for humans and agents

Shape, enrich, and route any security data with one pipeline language that humans and agents share. Your engineers write it directly, and your AI agents generate it from natural language.

Book a demo Start for free

Commandyour security data

Turn intent into deployable pipelines

Compose your security data pipelines

Collect

Parse

Normalize

Shape

Optimize

Anonymize

Enrich

Aggregate

Detect

Store

Search

Route

Replay

Connect the world of security and data

Fresh insights for security data teams

Why security teams choose Tenzir

One data pipeline for humans and agents

Command
your security data