Notifications
Clear all
Topic starter
01/08/2026 10:49 pm
TL;DR: A November 2021 update added a universal telemetry protocol, adapter-based ingestion, and 1 year retention for external logs while also extending sensor handling and UEBA reliability, according to LimaCharlie. The practical shift is not just broader collection, but tighter operational control over how security telemetry is normalized, retained, and turned into detections.
NHIMG editorial — based on content published by LimaCharlie: Developer Roll Up: November 2021
Questions worth separating out
Q: How should security teams govern telemetry pipelines that handle identity and cloud logs?
A: Treat the pipeline as a control layer, not a transport layer.
Q: Why does normalized telemetry matter for IAM and NHI monitoring?
A: Normalized telemetry lets teams correlate activity across users, service accounts, and tools without stitching together incompatible formats.
Q: What breaks when external logs are ingested without ownership and retention rules?
A: The main failure is evidentiary drift.
Practitioner guidance
- Define a telemetry trust model Classify which log sources are authoritative for identity, privilege, and secrets activity, then document who owns each source and how it is validated before ingestion.
- Normalize identity-rich events before detection Preserve user, workload, and session identifiers when mapping external logs into the SOC pipeline so investigations can link activity back to the right account or non-human identity.
- Apply retention by sensitivity class Set different retention and access rules for logs that can contain credentials, tokens, or administrative actions, rather than applying one blanket policy across all telemetry.
What's in the full article
LimaCharlie’s full blog post covers the operational detail this post intentionally leaves for the source:
- Specific adapter inputs and supported ingestion paths for S3, syslog, Pub/Sub, STDIN, and 1Password events
- Implementation notes for mapping third-party telemetry into first-class sensors and the EDR pipeline
- Pricing mechanics for Carbon Black sensor billing and per-gigabyte ingestion charges
- Sensor release notes covering macOS isolation fixes, Linux stability, and UEBA event regeneration
👉 Read LimaCharlie’s developer roll-up on telemetry ingestion, sensors, and SOC 2 →
Universal telemetry ingestion and SOC data handling: what changes for teams?
Explore further
01/08/2026 10:57 pm
Telemetry unification is becoming a governance problem, not just an engineering problem. Once external logs, endpoint telemetry, and secrets-related events are processed in one pipeline, the central issue becomes who can trust, query, and retain each source. That affects SOC evidence handling, IAM auditability, and NHI monitoring in the same control surface. Practitioners should treat normalization as an access and assurance control, not a plumbing task.
A question worth separating out:
Q: How can teams tell whether telemetry ingestion is improving security outcomes?
A: Look for better correlation quality, shorter investigation time, and fewer blind spots around privileged activity and secrets access. If more sources only increase volume, but analysts still cannot connect events back to an identity or control owner, the programme has expanded collection without improving governance.
👉 Read our full editorial: LimaCharlie’s telemetry ingestion update changes SOC data handling
