Notifications
Clear all
Topic starter
19/08/2026 3:51 pm
TL;DR: Embedded AI can parse unstructured logs, mask PII, and generate OTTL processor logic from plaintext requests, reducing the manual work of building telemetry pipelines, according to Edge Delta. The operational lesson is that telemetry governance now hinges on controlled transformation and visibility, not just collection volume.
NHIMG editorial — based on content published by Edge Delta: AI-powered telemetry pipelines and natural language processor creation
Questions worth separating out
A: Start by separating the governance problem into distinct control domains.
Q: Why do raw logs create problems for identity and access investigations?
A: Raw logs show that an action occurred, but they rarely show whether the actor was expected, whether the location was normal, or whether the source had a known threat reputation.
Q: What can go wrong when natural language creates pipeline processors?
A: The main risk is intent drift.
Practitioner guidance
- Approve pipeline changes before deployment Require human review of every AI-generated processor, especially where the change parses, masks, or deletes fields used by security analytics or investigations.
- Version-control transformation logic Store OTTL statements and natural language requests together so teams can audit why a processor was created and compare later edits against the original intent.
- Classify sensitive telemetry fields early Identify user identifiers, IP addresses, session data, and backend resource fields before they enter shared pipelines, then apply masking rules consistently across streams.
What's in the full article
Edge Delta's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step configuration of the Cloud Pipeline and processor chain used in the example.
- The exact OTTL statements generated for parsing, severity updates, and field deletion.
- The before-and-after telemetry output that shows how the transformations changed the log structure.
- How the plaintext custom processor request was translated into executable pipeline logic.
👉 Read Edge Delta's walkthrough of AI-powered telemetry pipeline processing →
Telemetry pipelines with natural language controls: what changes now?
Explore further
19/08/2026 4:26 pm
Telemetry pipeline governance is now a data security control, not just an observability task. Once pipelines can redact, parse, and restructure sensitive fields automatically, they influence what downstream teams can see and prove. That makes them part of the control surface for privacy, incident response, and access investigations. Security teams should treat pipeline change management as a governed workflow, not a convenience feature.
A question worth separating out:
Q: What should teams check before using automated masking and field removal?
A: Check whether the masked or removed fields are needed by SIEM rules, case management, compliance evidence, or access reviews. Teams should also confirm that transformations are consistent across all sources, because uneven masking creates blind spots and weakens comparability across logs, metrics, and traces.
👉 Read our full editorial: AI-powered telemetry pipelines reduce log processing friction
