Operations | Monitoring | ITSM | DevOps | Cloud

This update delivers significant advances in operational flexibility and security monitoring capabilities. It addresses the evolving needs of security teams across diverse deployment environments, from air-gapped networks to those prioritizing automation and simplicity, while expanding integration options and improving visibility into data flows.

Modern security operations teams face an overwhelming challenge: a rapidly growing volume of logs, alerts, and telemetry from cloud services, on-premises infrastructure, and third-party security tools. Traditional SIEM platforms often struggle to scale cost-effectively and provide the agility needed for advanced analytics and threat hunting.

Logstash has been a workhorse in data processing pipelines for years, but it was not designed with today’s security operations in mind. Security teams now deal with massive telemetry volumes, rising SIEM costs, and diverse log formats that require constant normalization. In this environment, Logstash shows its age: manual configuration, outdated parsing, and scalability bottlenecks introduce fragility instead of efficiency.

This month we’re rolling out several new capabilities designed to simplify daily work for SOC teams, MSSPs, and enterprise security operations. The focus is on easier access control, streamlined log management, and faster vendor onboarding.

Collecting Windows Security Events has always been a necessary but difficult job. Traditional methods depend on third-party collectors that must be installed, configured, and constantly maintained. They break, they lag behind updates, and they create unnecessary operational work. At the same time, they often flood Microsoft Sentinel with redundant or irrelevant data, driving up costs and slowing down investigations.

A practical guide for IT professionals, DevOps, security teams, platform engineers, and anyone who’s dealing with logs. In contemporary distributed systems, telemetry data—logs, metrics, traces, and events—serves as the primary mechanism for understanding internal system behavior. However, as system complexity increases, so does the volume and heterogeneity of telemetry.

We’re constantly improving DataStream to make security data management simpler, smarter, and more efficient for modern SOCs. This latest update introduces new capabilities that bring even more visibility and flexibility to your telemetry pipelines. Let’s take a closer look at what’s new.

We’re excited to announce that VirtualMetric has achieved SOC 2 Type 2 certification. This is a key step in our mission to deliver secure, resilient, and efficient telemetry solutions. This certification confirms that our controls for security, availability, confidentiality, and data integrity don’t just look good on paper — they work in practice, over time.

Over the past year, much of cybersecurity’s attention has centered on the promise of AI-powered SOCs. But as the Market Guide 2025 by Francis Odum reveals, the true foundation of modern security success lies in the data layer. “Without clean, well-routed telemetry, even the smartest AI is starved of context,” points out the researcher. And that’s where Security Data Pipeline Platforms (SDPPs) have become essential.