Beacon, Cribl, DataBahn and Tenzir

About Cribl

Cribl sells the AI Platform for Telemetry to IT and security teams. Cribl says it was founded to address a problem in which telemetry was exploding while the tools to manage and search it were rigid, expensive, and siloed. Cribl started by giving customers a way to route and shape telemetry, so they could keep more data and send it to the right places. Cribl describes its platform as vendor-agnostic, with a telemetry engine to automate investigations. Cribl says telemetry data continues to grow at 28% a year and logging systems are at capacity. Cribl says its platform turns telemetry into a shared, reusable foundation for IT, security, and AI-driven operations.^{[4][6][7][10][11]}

Cribl Stream integrates with 80+ sources and destinations, and portable Packs move entire pipelines as reusable bundles. Cribl Packs are bundles that package data routes, pipelines, and configurations. Collectors are fully supported in Cribl Packs for managing and shipping data from cloud, databases, and APIs. Copilot Editor in Cribl Stream maps schemas, transforms data, and filters data from plain language prompts.^[1][7]

Cribl Stream offers dynamic sampling to filter events or roll up logs into metrics. Cribl Stream can keep a full-fidelity copy in low-cost storage or a data lake and replay it later. Cribl Guard uses AI to spot sensitive data, like credit cards or social security numbers, as it flows through Cribl Stream. Cribl Guard includes human-in-the-loop review, so operators can approve or override actions before data is masked or blocked. Cribl as Code gives security, IT, and engineering teams programmatic control to automate, configure, and manage their Cribl environment.^[7][11]

Cribl Edge is a vendor-neutral agent for endpoint data collection. Cribl Edge is an agent for file monitoring, upgrades, and configurations that are managed through a GUI. Cribl Lake receives data that is less likely to be frequently used. Cribl Lake and Cribl Search are used for lower-cost retention and in-place search. Cribl Search is powered by a federated engine that searches data at rest and a lakehouse engine that searches data as soon as it is ingested. Cribl Search is a standalone offering, so Cribl Stream is not required to use it.^[8][9][10]

Cribl Search searches data in place and supports data lakes, object stores, analytics services, API endpoints, and more. Cribl Search includes AI-guided incident investigations, collaborative Notebooks, AI-assisted KQL query generation, reporting, and visualizations.

Cribl Detect is offered as a SIEM. Cribl describes its SIEM approach as decoupling analysis from storage. Cribl Copilot Editor helps create pipelines using natural language to accelerate migration to new SIEMs and storage locations. Cribl Stream adds context to security data sources, like GeoIP, indicators of compromise, and any other threat intelligence database. Cribl supports storing data in low-cost object storage and replaying it to any destination for incident response. Cribl says most organizations route all telemetry, logs, metrics, and traces, into a single costly tier. Cribl supports routing frequently used data to SIEMs and observability tools, less-used data to a lakehouse, and data to an archive tier for retention requirements. Cribl supports delivering log management as a governed, multi-tenant shared service.^{[4][9][10][11]}

Cribl offers a consumption-based model on its cloud platform, where Cribl Credits let customers allocate spending as demands change. Cribl offers volume-based licensing for Stream and Edge for customers who run their own infrastructure. Cribl offers multiple editions of its product suite. Enterprise customers get up to 3 Workspaces included for free, and additional Workspaces cost 250 credits per Workspace per month. FinOps Center tracks changes in data usage over time and ties them to events such as onboarding new sources or infrastructure shifts. Cribl Consulting Services provides advisory, delivery, optimization, and enablement work across a customer's Cribl environment, purchased through Service Credits.^[12][13]

Cribl was formed in San Francisco, California. Cribl completed a Series A with $7.4M in funding and a Series B with $35M raised, led by Sequoia Capital. Cribl announced a Series C with $200M led by Greylock and Redpoint Ventures. Cribl secured $150M in Series D funding led by Tiger Global Management. Cribl closed a $319 million Series E at a $3.5 billion valuation. Cribl acquired CardinalOps to expand its AI platform into security operations. Cribl achieved FedRAMP Authority to Operate for U.S. federal government agencies.^{[2][4][7][10][12]}

About DataBahn

DataBahn sells the Agentic Data Control Plane for security, observability and AI. DataBahn describes telemetry as scattered across pipelines, SIEMs, data lakes, object stores and cloud platforms. DataBahn decides where telemetry moves, what stays in place, and how people and AI agents access it, wherever it lives. The DataBahn platform combines four core products spanning collection, routing, insight and automation. DataBahn raised $40M in Series B funding led by Insight Partners.^{[1][3][4][5][6][9]}

The Data Pipeline is the foundation of the DataBahn Agentic Data Control Plane and collects telemetry from any source, then routes the right data to each destination. The Data Pipeline collects from endpoints, network, cloud, identity, SaaS, on-prem and OT, and delivers to any SIEM, data lake or downstream tool. Smart Edge supports both agent and agentless deployment and collects data from cloud, on-prem or vendor sources with edge analytics. Smart Edge collects telemetry from anywhere and reduces and shapes it at the source before routing it. Smart Edge supports agent and agentless data collection for legacy systems, APIs, containers and OT environments.^[1][5][7][8]

Highway cleans, transforms, filters and routes data to any destination. Highway tracks data lineage across every flow and replays archived logs. Cruz does data-engineering work: it discovers sources, maps fields to OCSF with confidence scores and a human in the loop, monitors pipeline health and self-heals when something breaks. Cruz transforms data into JSON, KVP, CEF and LEEF, and aligns it with OCSF, CIM, ECS, ASSIM and UDM.^{[1][7][9][10]}

DataBahn converts streamed telemetry to common schemas including ASIM, OCSF, CIM and UDM. DataBahn detects and masks sensitive fields in motion, before data reaches any destination. DataBahn offers a library of 700+ prebuilt integrations, plus AI-generated connectors for new sources. DataBahn deploys as SaaS, self-managed cloud, hybrid or completely on-prem. DataBahn provides role-based access control and audit logging across the platform, including governed access for AI agents. DataBahn does not lock customers into a SIEM, a data lake or an AI provider. DataBahn works with cloud, SIEM, data platform and AI partners, plus embedded and OEM relationships.^[4][6]

Search lets a user ask a question in plain language and get an answer from every connected source at once. Search accepts plain language or native SQL, KQL and SPL, and routes the query to engines such as Athena, Sentinel and SparkSQL. Search can be pointed at an S3 bucket or Azure Blob, infers the schema automatically and queries the data in place. Search shows the data scanned and the estimated cost of a large archive query before it runs. Reef turns raw data into contextual insights using graph-database technology and correlates signals across domains.^[3][5][11]

Lumen is the threat-hunting and forensics agent that correlates across sources and returns a cited timeline of activity. Lumen pulls in ticket and case context through MCP Hub. MCP Hub gives every agent a single path to systems through the open Model Context Protocol. MCP Hub records every call an agent makes, including what it touched, when, and on whose behalf.^[3][12][13]

Autonomous In-Stream Data Intelligence (AIDI) is the operating model behind the platform's agents. Specialized AI agents on the DataBahn platform run on data as it moves, monitoring quality, detecting gaps and drift, enforcing policy and protecting sensitive fields. Pulse scores every source in real time for schema drift, format changes and quality. Compass maps every log to MITRE ATT&CK tactics and techniques. Sentry detects and masks sensitive data while it moves, before it reaches any destination. Atlas auto-discovers every asset and enriches it with owner, business unit, type, hardware, network and CVE context. Onset flags indicators of compromise in the stream. Forge auto-generates connectors using models trained on API schemas and vendor docs. Signal reads SIEM rules and schemas, compares them with the data flowing upstream, and updates pipelines automatically.^{[1][2][3][4][5][6][9][12][13][14]}

About Tenzir

Tenzir sells an agentic telemetry pipeline for data-driven cyber defenders. The company describes the pipeline as the place where security data is collected, transformed and routed to the tools and storage that use it.^[1][3]

Tenzir turns a described outcome into a deployable pipeline. A user describes the outcome: onboard events, make them OCSF-compliant, and remove the noise. An agent then turns that intent into a deployable pipeline. A composer in Tenzir builds the pipeline from natural-language intents.^[3]

Data from hyperscaler, on-premises, and SaaS sources fans in to the Tenzir pipeline. As events travel the pipeline, they are collected, normalized to OCSF, enriched, optimized, and finally routed by category to SIEM, SOAR, and XDR tools and to the data lake. Tenzir lets agents collect, transform, and route data by assembling prebuilt operators into pipelines.^[1][3]

Tenzir pipelines are assembled from TQL building blocks: 235 operators and 250 functions. On the collection side, Tenzir pipelines fetch paginated API results over HTTP, follow the cursor links, unpack the response envelope, and publish what arrives for the next pipeline. Tenzir pipelines also receive Syslog over UDP and turn the message body into typed fields with key-value and request-line parsing.^[3]

Tenzir maps vendor fields into OCSF, ASIM, ECS, CIM, UDM, or a customer's own schema, and keeps whatever has no home yet. Tenzir pipelines drop what nobody queries and collapse repeats while the data is still in flight. Tenzir pipelines protect sensitive fields with encryption, pseudonymization, anonymization, masking, salted hashes, redaction, and drops. Tenzir pipelines add domain reputation and asset inventory from live lookup tables, then ask a local model to summarize what came back.^[3]

Tenzir pipelines model coding-agent behavior as operation distributions, duration thresholds, and distinct-session estimates. Tenzir pipelines spot SMB traffic spikes with event-time windows and a statistical baseline, while the events are still moving.^[3]

For storage and search, Tenzir pipelines persist compressed, encrypted Parquet in object storage. Tenzir offers federated search in TQL to query events where they live, and Tenzir pushes supported filters and field selections down to ClickHouse as SQL. Tenzir pipelines split, publish, fork, and load-balance streams to the right destinations, and they send alerts, archives, and SIEM feeds without duplicating collection work. Tenzir pipelines can also send stored events back to the start of the pipeline, repair bounded timestamp disorder, shift the timeline, and recreate an incident at twenty times its original speed.^[2][3]