TENZIR builds a security data pipeline for security operations teams. It collects telemetry from many sources, reshapes and enriches it, and routes it to the tools that need it, so analysts are not left stitching logs together by hand or paying to store data in the wrong format.
The problem is cost and friction. Every SIEM, data lake and analytics tool expects its own format, and sending everything everywhere is expensive, so security teams need one place to decide what data goes where and in what shape.
At A Glance
| Vendor | TENZIR |
|---|---|
| Category | Security data pipeline |
| Deployment | Hosted platform at app.tenzir.com, on premises or fully air gapped |
| Agentic AI | Pipeline composer that turns natural language intent into deployable pipelines |
| Customers | Dell, DCSO, DFN-CERT, Giesecke+Devrient, Swiss Post Cybersecurity |
| Founders | Dr. Matthias Vallentin and Dominik Charousset |
| Market classification | Security Operations |
What TENZIR Does
Security data arrives in dozens of formats from endpoints, clouds, network sensors and SaaS tools, and each destination expects something different. TENZIR sits in the middle as “the data pipeline engine for security teams”, handling the work between source and destination in one place. Raw events go in once, are cleaned, reduced and enriched, and leave in whatever form each destination needs, so the choice of SIEM or data lake stops dictating how data is collected. Normalisation can target OCSF, ASIM, ECS, CIM, UDM or a schema of the customer’s own, and sensitive fields can be masked before data leaves the pipeline.
Products
Tenzir Pipelines And TQL
A pipeline is a chain of operators, and TQL is the language used to write one. This is where the processing happens: teams collect from files, streams, APIs and message brokers, map events to OCSF or another common schema, add threat intelligence, build detections and dashboards, and send the output to destinations such as Splunk or an S3 data lake. Because TQL is a shared language, engineers can write it directly or have an AI agent generate it.
Tenzir Platform
The platform is fleet management for nodes. Security teams running many pipelines in different places use it to manage them through a web interface or API, administer users, organisations and workspaces, sign in through an external identity provider, and build dashboards from pipeline charts. Larger deployments add external secrets management, RBAC and audit logs.
How It Works
When a node starts, it tries to connect to the platform automatically. Without the platform, pipelines can still be controlled directly through the node API.
| Component | What it does |
|---|---|
| Nodes | The runtime: a running process that manages and executes pipelines. |
| Platform | An optional management layer above nodes, run by TENZIR at app.tenzir.com or deployed on premises, including in “fully air-gapped environments”. |
| Workspaces | Groups of nodes, secrets and dashboards owned by a user or an organisation. Each node belongs to exactly one workspace. |
Service providers running the platform on premises can separate customers in two ways: one platform per customer for physical separation, or one organisation per customer on a shared platform for logical separation. Customers can also keep the whole data lake inside their own AWS VPC.
Agentic AI Capabilities
Pipeline Composer
The composer starts from a natural language intent and has an agent turn it into a deployable pipeline. The result is ordinary TQL, so an engineer can read, edit or extend what the agent produced before it goes live. Agent skills are available for teams that want their own AI agents to work with TQL.
AI Enrichment And Agent Analytics
Enrichment can call a local model to summarise enriched events, with a documented example running on a local Ollama instance. On the analysis side, an example pipeline models the activity of coding agents.
Integrations
Integrations come in two layers: one-click deployable packages and native connectors over many protocols and APIs.
| Area | Integrations |
|---|---|
| SIEM | Splunk, Elastic, Microsoft Sentinel, Google SecOps, OpenSearch |
| Cloud and SaaS | Amazon S3, Google Cloud Storage, Azure Blob Storage, Amazon CloudWatch Logs, Google Cloud Logging, Microsoft Graph, Wiz, Zscaler, Box, GitHub, Slack |
| Data lakes and analytics | Snowflake, Databricks, ClickHouse, Hydrolix, Microsoft SQL Server, MySQL, Prometheus |
| Message brokers | Kafka, NATS, Amazon SQS, AMQP |
| Endpoint security | CrowdStrike, SentinelOne, Velociraptor, Wazuh |
| Threat intelligence | MISP, OpenCTI |
| Identity | Microsoft Entra ID |
| Network and vulnerability | Palo Alto, Fortinet, Zeek, Suricata, Qualys |
Company Background
| Office | Hamburg, Germany |
|---|---|
| Leadership | Dr. Matthias Vallentin, Co-Founder and CEO; Dominik Charousset, Co-Founder and CTO |
| Funding | An angel financing round of undisclosed size, plus the InnoRampUp grant from IFB |
Note: This overview is compiled from TENZIR’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.