What does Tenzir sell?

Tenzir sells TQL. TQL: The building blocks from which Tenzir pipelines are assembled, with 235 operators and 250 functions.

From its own pages, Tenzir sells to data-driven cyber defenders who handle security telemetry. The pages describe sources in hyperscaler, on-premises and SaaS environments. The destinations they name are SIEM, SOAR and XDR tools and a data lake. The pages also describe Tenzir as an agentic telemetry pipeline, so the fit is teams that want to build pipelines from described intents.

How does CISO Tribune file Tenzir?

CISO Tribune files Tenzir under Security data lakes and pipelines.

Company record · security vendor

Tenzir

Where Tenzir appears on the record (15)

Every page on CISO Tribune and its network that carries this company, 15 in all.

Compared with (13): vs Anomali, vs Beacon, vs Cribl, vs DataBahn, vs Daylight, vs Devo, vs Hunters, vs Mars Security, vs Panther, vs Realm Security, vs RunReveal, vs Splunk, vs Sumo Logic
In the vendor directory (2): Security data lakes and pipelines vendors · primary category
SOC vendors: who they are and how CISOs compare them, from MDR to SIEM · vendor guide

What the company sells

Tenzir sells an agentic telemetry pipeline for data-driven cyber defenders. The company describes the pipeline as the place where security data is collected, transformed and routed to the tools and storage that use it.

Tenzir turns a described outcome into a deployable pipeline. A user describes the outcome: onboard events, make them OCSF-compliant, and remove the noise. An agent then turns that intent into a deployable pipeline. A composer in Tenzir builds the pipeline from natural-language intents.

Data from hyperscaler, on-premises, and SaaS sources fans in to the Tenzir pipeline. As events travel the pipeline, they are collected, normalized to OCSF, enriched, optimized, and finally routed by category to SIEM, SOAR, and XDR tools and to the data lake. Tenzir lets agents collect, transform, and route data by assembling prebuilt operators into pipelines.

Tenzir pipelines are assembled from TQL building blocks: 235 operators and 250 functions. On the collection side, Tenzir pipelines fetch paginated API results over HTTP, follow the cursor links, unpack the response envelope, and publish what arrives for the next pipeline. Tenzir pipelines also receive Syslog over UDP and turn the message body into typed fields with key-value and request-line parsing.

Tenzir maps vendor fields into OCSF, ASIM, ECS, CIM, UDM, or a customer's own schema, and keeps whatever has no home yet. Tenzir pipelines drop what nobody queries and collapse repeats while the data is still in flight. Tenzir pipelines protect sensitive fields with encryption, pseudonymization, anonymization, masking, salted hashes, redaction, and drops. Tenzir pipelines add domain reputation and asset inventory from live lookup tables, then ask a local model to summarize what came back.

Tenzir pipelines model coding-agent behavior as operation distributions, duration thresholds, and distinct-session estimates. Tenzir pipelines spot SMB traffic spikes with event-time windows and a statistical baseline, while the events are still moving.

For storage and search, Tenzir pipelines persist compressed, encrypted Parquet in object storage. Tenzir offers federated search in TQL to query events where they live, and Tenzir pushes supported filters and field selections down to ClickHouse as SQL. Tenzir pipelines split, publish, fork, and load-balance streams to the right destinations, and they send alerts, archives, and SIEM feeds without duplicating collection work. Tenzir pipelines can also send stored events back to the start of the pipeline, repair bounded timestamp disorder, shift the timeline, and recreate an incident at twenty times its original speed.^[1][2][3]

Categories: Security data lakes and pipelines (primary category)
Compare Tenzir with companies in the same category
Headquarters: Not established from our sources
Founded: Not established from our sources
Ownership: Privately held
CISO on record: Not yet on our record. Send a verified source
Website: tenzir.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

TQL^[3]
The building blocks from which Tenzir pipelines are assembled, with 235 operators and 250 functions.
Tenzir pipelines are assembled from TQL building blocks: 235 operators and 250 functions. TQL is used for federated search of events where they live. Tenzir pushes supported filters and field selections down to ClickHouse as SQL.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of Tenzir's categories, then alphabetical. A list from the record, never a ranking.

On security data lakes and pipelines, Tenzir competes with Beacon, Cribl, DataBahn, Devo, Mars Security, Realm Security, Anomali, Daylight, Hunters, Panther and 3 more.

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

[1]tenzir.comTenzir · tenzir.com · undated page, accessed November 6, 2026 · Tier A: the company, a regulator or a filing
[2]PressTenzir · tenzir.com · undated page, accessed November 6, 2026 · Tier A: the company, a regulator or a filing
[3]Tenzir — Command Your Security DataTenzir · undated page, accessed November 11, 2026 · Tier A: the company, a regulator or a filing

Last verified November 6, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded November 6, 2026, expanded November 11, 2026 from the references above.

Work for Tenzir? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.

Security leadership

CISO Tribune has not yet recorded who holds the top security seat at Tenzir. We add a seat only from a verified source; if you have one, send it to the desk.

Questions CISOs ask about Tenzir

What does Tenzir sell?: Tenzir sells TQL. TQL: The building blocks from which Tenzir pipelines are assembled, with 235 operators and 250 functions.
Who does Tenzir fit?: From its own pages, Tenzir sells to data-driven cyber defenders who handle security telemetry. The pages describe sources in hyperscaler, on-premises and SaaS environments. The destinations they name are SIEM, SOAR and XDR tools and a data lake. The pages also describe Tenzir as an agentic telemetry pipeline, so the fit is teams that want to build pipelines from described intents.
How does CISO Tribune file Tenzir?: CISO Tribune files Tenzir under Security data lakes and pipelines.
Who owns Tenzir?: Tenzir is privately held.

Related guides

CISO Reporting Structure, the Five Models and What the Filings Show
Most security chiefs report into technology leadership (64%), the rest to business leaders. The five models, their trade-offs and what 10-K filings show.
CISO News: Tracking Every Appointment and Departure in the Top Security Seat
CISO Tribune records every CISO appointment and departure as a sourced, dated entry, not a column: 466 moves to date, each with a primary source and a confirmed-or-reported label.
CISO, CSO, VP of Security, Head of Security: What the Titles Mean and What the Record Shows
A chief information security officer (CISO) owns information security. A chief security officer (CSO) usually adds physical security and investigations.