Tarsal builds a security data pipeline for security teams. It collects logs from SaaS applications, cloud infrastructure and security tools, normalises them into a standard format and delivers them to the data lakes, SIEMs and XDRs those teams already run.
The problem it targets is the engineering effort behind security data. Every new source usually needs its own parser and every destination its own format, and that work has to be maintained as tools change. Tarsal takes that work off the team, so analysts spend less time on plumbing and more on detection. Tarsal is now part of Monad.
At A Glance
| Vendor | Tarsal, now part of Monad |
|---|---|
| Category | Security data pipeline (ETL) |
| Sources | SaaS, cloud and security logs |
| Destinations | Data lakes, SIEMs and XDRs |
| Customers | Robinhood, Navan, Upstart |
| Funding | Seed round led by Harpoon Ventures and Mango Capital |
| Market classification | Security Operations |
What Tarsal Does
Security teams collect data from dozens of systems, and each one formats its logs differently. Before that data is useful for detection or investigation, someone has to extract it, parse it, map it to a common schema and load it somewhere it can be queried. Tarsal automates that whole extract, transform and load cycle for security data.
The same pipeline helps teams manage SIEM cost. A team can keep its SIEM in place, send some or all of the same data to a lower-cost data lake and move analytics across gradually. Because the data arrives normalised, the data lake is usable from the first day.
Products
Tarsal Security Data Pipeline
The pipeline is Tarsal’s single product, aimed at security operations and detection teams who spend too much time building and maintaining log pipelines. Its main capabilities are:
- Pre-built connectors for SaaS, cloud and security logs. Tarsal maintains the connectors, so the customer does not
- Native schemas for the most important security sources
- Automatic normalisation, so every destination receives data in the same standard format
- Switching from one destination to another without rebuilding the pipeline
- Capacity that grows with the organisation’s data volumes
How It Works
| Component | What it does |
|---|---|
| Sources | Connectors collect data from SaaS audit logs, cloud infrastructure logs, identity application logs and other security logs. |
| Normalisation | Incoming events are mapped to Tarsal’s native schemas, so the same kind of event looks the same regardless of where it came from. |
| Routing | The normalised data is sent to one or more destinations, typically a data lake, a SIEM or an XDR. The same stream can feed a SIEM and a data lake side by side. |
| Configuration | Sources and destinations are set up without code, and a new destination can be added in one step. |
Company Background
| Founder | Sunny Rekhi |
|---|---|
| Leadership | Barrett Lyon, CTO |
| Funding | $6 million seed round (March 2024) |
| Acquisition | Acquired by Monad, a security data pipeline company; the Tarsal team joined Monad |
| Programmes | Tarsal is a Y Combinator company |
Note: This overview is compiled from Tarsal’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.