/

Use Case

/

Security Data Lake

Use Case

/

Security Data Lake

Own your data. Decouple storage from analytics

Own your data. Decouple storage from analytics

Build a high-performance security data lake on open standards. Store years of telemetry in cost-effective object storage while keeping it queryable in seconds without re-hydration.

90%

SIEM cost reduction

90%

SIEM cost reduction

90%

SIEM cost reduction

Zero

Native support

Zero

Native support

Zero

Native support

Native

Parquet support

Native

Parquet support

The Problem

The retention tax of legacy SIEMs

The retention tax of legacy SIEMs

Keeping data hot in a SIEM for compliance or forensics is financially impossible. So you archive it to cold storage where it effectively disappears. Bringing that data back for an investigation takes days and costs a fortune, leaving your analysts blind when digging into the past.
The Solution
The Solution
The Solution

Turn cold storage into an active security lake

Apply granular logic to your data streams. Shape, shrink, and route your logs with a lightweight architecture designed for modern security stacks.
Open storage formats

Write natively to open formats like Apache Parquet to avoid vendor lock-in. Make your security data instantly accessible to tools like Spark without paying a tax.

Open storage formats

Write natively to open formats like Apache Parquet to avoid vendor lock-in. Make your security data instantly accessible to tools like Spark without paying a tax.

Open storage formats

Write natively to open formats like Apache Parquet to avoid vendor lock-in. Make your security data instantly accessible to tools like Spark without paying a tax.

Hot speed, cold price

Search terabytes of historical data in S3 in seconds using our compact index. Query cold storage as if it were hot and find the exact needle in the haystack.

Hot speed, cold price

Search terabytes of historical data in S3 in seconds using our compact index. Query cold storage as if it were hot and find the exact needle in the haystack.

Hot speed, cold price

Search terabytes of historical data in S3 in seconds using our compact index. Query cold storage as if it were hot and find the exact needle in the haystack.

Schema on write

Normalize messy logs into OCSF as they enter the lake. Clean, structured data ensures faster queries, optimized storage costs, and happier data scientists.

Schema on write

Normalize messy logs into OCSF as they enter the lake. Clean, structured data ensures faster queries, optimized storage costs, and happier data scientists.

Schema on write

Normalize messy logs into OCSF as they enter the lake. Clean, structured data ensures faster queries, optimized storage costs, and happier data scientists.

Deep Dive
Deep Dive
Deep Dive

The engine for your open data lake

Apply granular logic to your data streams. Shape, shrink, and route your logs with a lightweight architecture designed for modern security stacks.

from file "/var/log/firewall/*.json"
| publish “firewall-logs”
| fork
// Path 1: High severity to SIEM
| where severity >= “high” | to splunk,
// Path 2: Everything to Data Lake
| where parquet | to s3 bucket=“security-lake”

from file "/var/log/firewall/*.json"
| publish “firewall-logs”
| fork
// Path 1: High severity to SIEM
| where severity >= “high” | to splunk,
// Path 2: Everything to Data Lake
| where parquet | to s3 bucket=“security-lake”

from file "/var/log/firewall/*.json"
| publish “firewall-logs”
| fork
// Path 1: High severity to SIEM
| where severity >= “high” | to splunk,
// Path 2: Everything to Data Lake
| where parquet | to s3 bucket=“security-lake”

A pipeline that routes critical alerts to Splunk while archiving the full dataset to S3 in optimized Parquet format for long-term analysis.

Why Tenzir powers the modern data lake

Passive archives

Customers often see 30-50% lower ingestion costs compared to legacy SIEM ingestion.

Proprietary, closed formats
Painful re-hydration required
Data silos (SIEM lock-in)

Tenzir turns low-cost storage into a high-performance query engine. Keep your data open, accessible, and ready for instant analysis at any time without delay

Open standards (Parquet/Arrow)
Query directly in storage
Bring-your-own-tool
Integrations

Connect the world of security and data

Whether you build on AWS S3, Google Cloud Storage, Snowflake, or MinIO, Tenzir integrates natively to build your data fabric.

Integrations

Connect the world of security and data

Whether you build on AWS S3, Google Cloud Storage, Snowflake, or MinIO, Tenzir integrates natively to build your data fabric.

Integrations

Connect the world of security and data

Whether you build on AWS S3, Google Cloud Storage, Snowflake, or MinIO, Tenzir integrates natively to build your data fabric.

Unlock the value of

historical data

Don't let your data die in cold storage. Build a high-performance, open security data lake that serves your analysts and your budget.
Explore Tenzir on your own

Start instantly with the Tenzir Community Edition. Log in to get hands-on with core features.

Read tutorial and guides

Our docs come with tutorials, explanations, and a rich reference. Everything you need to start.

Join the community

Share your thoughts and questions with our community of security and data enthusiasts.

Unlock the value of

historical data

Don't let your data die in cold storage. Build a high-performance, open security data lake that serves your analysts and your budget.
Explore Tenzir on your own

Start instantly with the Tenzir Community Edition. Log in to get hands-on with core features.

Read tutorial and guides

Our docs come with tutorials, explanations, and a rich reference. Everything you need to start.

Join the community

Share your thoughts and questions with our community of security and data enthusiasts.

Unlock the value of

historical data

Don't let your data die in cold storage. Build a high-performance, open security data lake that serves your analysts and your budget.
Explore Tenzir on your own

Start instantly with the Tenzir Community Edition. Log in to get hands-on with core features.

Read tutorial and guides

Our docs come with tutorials, explanations, and a rich reference. Everything you need to start.

Join the community

Share your thoughts and questions with our community of security and data enthusiasts.