VirtualMetric builds a security data pipeline for security operations teams and MSSPs that are paying to ingest more telemetry than their SIEM actually needs. Its platform sits between log sources and security tools, trimming and shaping data before it is stored so that detection rules get what they use and the rest goes somewhere cheaper.
The platform, DataStream, is meant for teams that want lower ingestion bills without losing the data their detections need, including MSSPs running many customers at once.
At A Glance
| Vendor | VirtualMetric |
|---|---|
| Category | Security Operations, security data pipeline |
| Deployment | Directors managed by VirtualMetric, serverless on Docker or Kubernetes, or self-managed (Enterprise) |
| Agentic AI | DataStream MCP server for coding assistants |
| Customers | ABB, Turkcell, Wortell, Evolution Systems, Marmara University |
| Certifications | ISO 27001, SOC 2 Type II |
| Market classification | Security Operations |
What VirtualMetric Does
Not all telemetry belongs in a SIEM, yet most organisations send everything and pay for it. DataStream decides what reaches each destination. It parses logs and maps them to the schema each tool expects, drops events and fields that no detection rule uses, adds context through content packs, and sends the result on to SIEMs, data lakes and long-term storage.
The output is detection-ready in real time and structured for AI agents, automated playbooks and analytics further down the line.
Products
DataStream
DataStream works in four stages: collect, normalise and enrich, filter and route, and accelerate. It is aimed at SOC and platform teams that want control over telemetry volume and format without writing custom code for every source.
- Secure, read-only collection, with agents only where needed
- A Smart Engine that keeps the fields and events detection rules rely on and drops the rest before ingestion
- More than 220 low-code or no-code processors using Elastic Ingest Pipeline syntax
- A vectorised engine that spreads batch processing across all CPU cores
- The VMF storage format, with a reported 99% compression plus Bloom Filters and LogChain
- Write-Ahead Log technology that keeps data intact through interruptions
- A Correlation ID on every log to link related events across platforms
- Pipeline testing on sample or live logs, with unit tests and staged rollouts
For service providers, an MSSP module lets one tenant manage multiple customers.
DataStream MCP Server
DataStream has an MCP server that coding assistants such as Claude Code can connect to. Engineers use it to have an assistant write pipelines and test them against the real engine. The server has no access to the customer deployment or to live data, so pipeline development can be automated without exposing logs.
How It Works
DataStream runs as Directors, processing nodes inside the customer environment that are managed from the VirtualMetric cloud console. Setup is automated and needs no system restarts.
| Component | What it does |
|---|---|
| Collection | Data is gathered agentlessly over read-only access, or through a lightweight agent where a source requires it. |
| Hosting options | On every plan, Directors can be managed by VirtualMetric or run serverless on Docker or Kubernetes. The Enterprise plan adds self-managed Directors on the customer’s own hosts, including air-gapped networks. |
| Data residency | Log data stays in the customer environment in every model. Only configuration and metadata sync to the cloud. |
Integrations
| Area | Integrations |
|---|---|
| Sources (330+ in total) | Zscaler, Fortinet, Windows Server, F5, Palo Alto Networks, CrowdStrike, CyberArk |
| SIEM destinations | Microsoft Sentinel, Google SecOps, Splunk Enterprise Security, Elastic Security, QRadar |
| Data lake and storage | Microsoft Sentinel data lake, Azure Data Explorer, Azure Blob Storage, Amazon Security Lake, Elasticsearch |
Company Background
| Founded | 2016, by Yusuf Ozturk. |
|---|---|
| Headquarters | The Netherlands. |
| Funding | Raised €2.25 million, and won at ECSO Cyber Investors Days 2024. |
| Recognition | SACR 2026 Security Data Pipeline Platform report, in the emerging and integration depth categories. |
Note: This overview is compiled from VirtualMetric’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.