What do Mars Security and Tenzir sell?

Mars Security sells Mars. Tenzir sells TQL.

Are Mars Security and Tenzir in the same category?

Yes. Security data lakes and pipelines is the primary category of both on CISO Tribune.

Who are Mars Security and Tenzir sold to?

From its own pages, Mars Security sells to organizations that run a security program of their own. From its own pages, Tenzir sells to data-driven cyber defenders who handle security telemetry.

What have Mars Security and Tenzir announced recently?

September 8, 2026: Mars Security announced Real-Time Intel-Based Detection, a capability that turns newly published threat intelligence into validated detection rules within minutes of release.

Vendor comparison · 2 companies

Mars Security vs Tenzir

Mars Security provides Mars, a platform for hunting across log sources, cloud and endpoint data and for building and testing detections without ingestion pipelines. Tenzir sells an agentic telemetry pipeline for data-driven cyber defenders. CISO Tribune files both under Security data lakes and pipelines. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

Mars Security
Tenzir

Add a company

Mars Security vs Tenzir: Products, Customers and Funding Compared
What it sells
	Mars SecurityMars Security provides Mars, a platform for hunting across log sources, cloud and endpoint data and for building and testing detections without ingestion pipelines.marssec.ai	TenzirTenzir sells an agentic telemetry pipeline for data-driven cyber defenders.tenzir.com
What it sells	Mars^[2][3][4]A platform for hunting across log sources, cloud and endpoint data without ingestion pipelines.	TQL^[3]The building blocks from which Tenzir pipelines are assembled, with 235 operators and 250 functions.
Categories
Categories	Security data lakes and pipelines (primary category)	Security data lakes and pipelines (primary category)
Headquarters
Headquarters	Not stated on its pages	Not stated on its pages
Founded
Founded	Not stated on its pages	Not stated on its pages
Ownership and funding
Ownership and funding	Not stated on its pages	Privately held
Named customers
Named customers	Not stated on its pages	Not stated on its pages
Recent news
Recent news	September 8, 2026Mars Security announced Real-Time Intel-Based Detection, a capability that turns newly published threat intelligence into validated detection rules within minutes of release.^[4]	Not stated on its pages
G2 and Gartner Peer Insights
G2 and Gartner Peer Insights	G2: Not stated on its pages Gartner Peer Insights: Not stated on its pages	G2: Not stated on its pages Gartner Peer Insights: Not stated on its pages
Who it fits
Who it fits	From its own pages, Mars Security sells to organizations that run a security program of their own. Our reading is that the pages address teams that build, test and ship detections against their own live data. The pages speak to buyers that already run a security stack, which Mars connects to by API without replacing tools.	From its own pages, Tenzir sells to data-driven cyber defenders who handle security telemetry. The pages describe sources in hyperscaler, on-premises and SaaS environments. The destinations they name are SIEM, SOAR and XDR tools and a data lake. The pages also describe Tenzir as an agentic telemetry pipeline, so the fit is teams that want to build pipelines from described intents.
Last verified
Last verified	October 29, 2026	November 6, 2026

Where they overlap

Security data lakes and pipelines is the primary category of both Mars Security and Tenzir.

Where they differ, field by field

Mars Security lists Mars. Tenzir lists TQL.
Tenzir is privately held.

What it sells: Mars Security

What Mars does^[2][3][4]: Mars Security says Mars deploys in hours with zero ingestion pipelines to build or maintain. Detections can be built, tested and shipped directly against live data. Mars connects to existing tools by API.

What it sells: Tenzir

What TQL does^[3]: Tenzir pipelines are assembled from TQL building blocks: 235 operators and 250 functions. TQL is used for federated search of events where they live. Tenzir pushes supported filters and field selections down to ClickHouse as SQL.

Questions about Mars Security and Tenzir

What do Mars Security and Tenzir sell?: Mars Security sells Mars. Tenzir sells TQL.
Are Mars Security and Tenzir in the same category?: Yes. Security data lakes and pipelines is the primary category of both on CISO Tribune.
Who owns Mars Security and Tenzir?: Tenzir is privately held.
Who are Mars Security and Tenzir sold to?: From its own pages, Mars Security sells to organizations that run a security program of their own. From its own pages, Tenzir sells to data-driven cyber defenders who handle security telemetry.
What have Mars Security and Tenzir announced recently?: September 8, 2026: Mars Security announced Real-Time Intel-Based Detection, a capability that turns newly published threat intelligence into validated detection rules within minutes of release.

About Mars Security

Mars Security provides Mars, a platform for hunting across log sources, cloud and endpoint data and for building and testing detections without ingestion pipelines.

Mars Security says Mars lets security teams hunt across every log source, cloud, and endpoint without moving a byte. The company states that Mars deploys in hours with zero ingestion pipelines to build or maintain, so teams can query their entire environment from day one, with full organizational context across every asset, user, and activity.^[1][2]

For detection engineering, Mars Security says teams can build, test, and ship detections directly against their live data, without the lag of traditional pipelines slowing the engineering cycle.^[2]

Mars Security describes a second aim: aligning a security program to the threats that are targeting an organization right now, rather than last quarter's incidents. The company says that in an era where attacks move at machine speed, detection and response has to match. Mars Security says the goal is to get ahead of adversaries, demonstrate proactive defense, and close the gap between the program and the real world.^[2]

On connectivity, Mars connects to an existing security stack by API, with no data ingestion and no tool replacement. Mars Security says Mars connects to any source with an API.^[1][3]

Mars Security on the record

About Tenzir

Tenzir sells an agentic telemetry pipeline for data-driven cyber defenders. The company describes the pipeline as the place where security data is collected, transformed and routed to the tools and storage that use it.^[1][3]

Tenzir turns a described outcome into a deployable pipeline. A user describes the outcome: onboard events, make them OCSF-compliant, and remove the noise. An agent then turns that intent into a deployable pipeline. A composer in Tenzir builds the pipeline from natural-language intents.^[3]

Data from hyperscaler, on-premises, and SaaS sources fans in to the Tenzir pipeline. As events travel the pipeline, they are collected, normalized to OCSF, enriched, optimized, and finally routed by category to SIEM, SOAR, and XDR tools and to the data lake. Tenzir lets agents collect, transform, and route data by assembling prebuilt operators into pipelines.^[1][3]

Tenzir pipelines are assembled from TQL building blocks: 235 operators and 250 functions. On the collection side, Tenzir pipelines fetch paginated API results over HTTP, follow the cursor links, unpack the response envelope, and publish what arrives for the next pipeline. Tenzir pipelines also receive Syslog over UDP and turn the message body into typed fields with key-value and request-line parsing.^[3]

Tenzir maps vendor fields into OCSF, ASIM, ECS, CIM, UDM, or a customer's own schema, and keeps whatever has no home yet. Tenzir pipelines drop what nobody queries and collapse repeats while the data is still in flight. Tenzir pipelines protect sensitive fields with encryption, pseudonymization, anonymization, masking, salted hashes, redaction, and drops. Tenzir pipelines add domain reputation and asset inventory from live lookup tables, then ask a local model to summarize what came back.^[3]

Tenzir pipelines model coding-agent behavior as operation distributions, duration thresholds, and distinct-session estimates. Tenzir pipelines spot SMB traffic spikes with event-time windows and a statistical baseline, while the events are still moving.^[3]

For storage and search, Tenzir pipelines persist compressed, encrypted Parquet in object storage. Tenzir offers federated search in TQL to query events where they live, and Tenzir pushes supported filters and field selections down to ClickHouse as SQL. Tenzir pipelines split, publish, fork, and load-balance streams to the right destinations, and they send alerts, archives, and SIEM feeds without duplicating collection work. Tenzir pipelines can also send stored events back to the start of the pipeline, repair bounded timestamp disorder, shift the timeline, and recreate an incident at twenty times its original speed.^[2][3]

Tenzir on the record

Sources

Mars Security full record

[1]marssec.aiMARS Security · marssec.ai · undated page, accessed October 29, 2026 · Tier A
[2]MARS SecurityMars Security · undated page, accessed November 5, 2026 · Tier A
[3]Integrations | MARS SecurityMars Security · undated page, accessed November 5, 2026 · Tier A
[4]Mars Security Launches Real-Time Intel-to-Detection Engine That Turns Live Threat Intelligence Into Backtested Detections in MinutesGlobeNewswire · published September 8, 2026 · Tier A

Tenzir full record

[1]tenzir.comTenzir · tenzir.com · undated page, accessed November 6, 2026 · Tier A
[2]PressTenzir · tenzir.com · undated page, accessed November 6, 2026 · Tier A
[3]Tenzir — Command Your Security DataTenzir · undated page, accessed November 11, 2026 · Tier A

Spot a factual error? Request a correction.