Telemetry Shaping

Expanded Definition

telemetry shaping is the controlled modification of security event streams before they are stored, indexed, or analysed. It includes filtering, aggregation, normalisation, sampling, and field reduction, all intended to make telemetry more usable without eliminating evidence needed for investigation. In cybersecurity operations, the term is most relevant where high-volume logs, identity events, endpoint data, and cloud signals must be made workable for SIEM, SOAR, and detection engineering. The practice sits between raw collection and analytical use, so its value depends on preserving enough context to reconstruct what happened.

Because definitions vary across vendors, telemetry shaping is not a single formal control domain. NHI Management Group treats it as a governance and engineering discipline that should preserve provenance, time ordering, and security-relevant fields. That is especially important when identity, access, or agent activity is involved, because over-shaping can remove the very attributes needed to detect misuse, privilege escalation, or anomalous automation. For a governance baseline, the NIST Cybersecurity Framework 2.0 remains the clearest reference point for managing visibility as part of security outcomes.

The most common misapplication is treating telemetry shaping as routine log cleanup, which occurs when teams remove fields or events without a documented investigative requirement.

Examples and Use Cases

Implementing telemetry shaping rigorously often introduces a traceability constraint, requiring organisations to weigh storage and processing efficiency against forensic depth.

• A SOC aggregates repeated authentication failures into session-level summaries to reduce noise, while retaining source IP, identity, and timestamp fields for investigation.
• A cloud security team trims verbose application logs before SIEM ingestion, but keeps action, principal, and resource identifiers so access abuse remains detectable.
• An IAM team reshapes identity telemetry to flag only high-risk changes, such as privilege grants or MFA resets, rather than every routine profile update.
• An NHI program reduces agent event volume by grouping repeated token refreshes, while preserving tool calls and execution context to support incident review.
• Detection engineers reshape endpoint telemetry to standardise field names across platforms, improving correlation without changing the underlying security meaning.

In mature environments, shaping should be tied to use cases rather than convenience. If the objective is fraud detection, incident response, or privileged access review, the shaped dataset must still support those outcomes. For identity-heavy pipelines, guidance from OWASP NHI guidance is useful because it highlights the need to retain signals that distinguish legitimate automation from abuse.

Why It Matters for Security Teams

Telemetry shaping matters because security teams rarely have the capacity to retain and analyse everything at full fidelity. The right shaping strategy improves searchability, cuts storage cost, and makes detections more actionable. The wrong strategy creates blind spots, especially when it removes identity context, sequence information, or tool invocation details that analysts need to verify intent. That risk is higher in cloud and agentic environments, where a single event may represent a human user, a service account, or an autonomous agent acting with delegated authority.

From a governance perspective, telemetry shaping should be reviewed alongside logging standards, retention policy, and incident response requirements. Frameworks such as NIST Cybersecurity Framework 2.0 and operational guidance from NIST SP 800-92 help teams think about logging as a security capability, not just a data pipeline. For identity-centric environments, shaped telemetry must still support access review, anomaly detection, and reconstruction of privileged actions.

Organisations typically encounter the real cost of telemetry shaping only after an incident investigation stalls because the retained data no longer explains who did what, when, and through which identity.

Related resources from NHI Mgmt Group

• Identity Telemetry Shaping
• When should organisations treat runtime telemetry as a primary control?
• Should organisations require security telemetry before adopting SaaS tools?
• Who should own trust telemetry when reporting spans NHI and cryptography controls?