Notifications
Clear all
Topic starter
18/08/2026 2:25 pm
TL;DR: Security data pipelines are breaking under the weight of logs, alerts, enrichment demands, and SIEM costs, according to TENZIR’s analysis of SecDataOps and open, composable pipeline design. The practical shift is from ingest-everything architectures to dynamic preprocessing, which changes how teams control cost, context, and data ownership.
NHIMG editorial — based on content published by TENZIR: Security Data Is Broken. It's Time to Fix It
Questions worth separating out
Q: How should security teams reduce SIEM costs without creating blind spots?
A: Security teams should move from ingest-everything thinking to governed data routing.
Q: Why do security graphs matter for IAM and NHI programmes?
A: Security graphs matter because they connect entitlements, behaviours, systems, and data into a single relationship view.
Q: What breaks when security teams rely on vendor-controlled ingestion models?
A: They usually inherit rigid parsing rules, limited preprocessing options, and higher storage costs.
Practitioner guidance
- Move enrichment upstream Normalize, enrich, and correlate security events before they reach the SIEM so you reduce storage cost and preserve context for downstream identity and threat analysis.
- Define pipeline ownership for identity telemetry Assign clear ownership for authentication, privilege, and non-human identity data flows so the organisation can govern retention, routing, and transformation decisions consistently.
- Standardise on open data formats Use open and interoperable formats such as Apache Arrow where possible so security telemetry can move between analytics, detection, and response tools without re-parsing.
What's in the full article
TENZIR's full article covers the operational detail this post intentionally leaves for the source:
- How TQL is used to compose security data pipelines as code for real operational workflows
- The specific enrichment, filtering, and correlation operators the vendor describes for stream processing
- Examples of how open standards and Apache Arrow are positioned for security data interoperability
- The practical mechanics of routing telemetry to downstream tools while reducing SIEM ingestion volume
👉 Read TENZIR's analysis of SecDataOps and security data pipeline design →
SecDataOps and SIEM costs: what security teams need to know?
Explore further
18/08/2026 3:15 pm
SecDataOps is becoming a governance model, not just a tooling pattern. Security teams are no longer deciding only how to ingest more data. They are deciding where to apply control, cost, and context enrichment in the data lifecycle. That shift matters because telemetry quality now influences everything from detection fidelity to identity investigation speed. Practitioners should treat pipeline design as part of security governance, not an engineering afterthought.
A question worth separating out:
Q: How can security teams tell whether identity fabric is working?
A: Security teams can tell identity fabric is working when policy intent is enforced consistently, access changes propagate cleanly, and audit evidence can be reconciled across environments. If teams still need manual translation between clouds to understand entitlements or revocation, the fabric is not yet doing its job.
👉 Read our full editorial: SecDataOps is reshaping how security teams handle pipeline chaos
