Security Telemetry Pipeline for Microsoft Security

DataStream is VirtualMetric’s high-performance security telemetry pipeline solution, built to optimize data ingestion, routing, and storage across Microsoft’s security ecosystem. Designed to reduce costs and simplify log management, DataStream delivers seamless integration with Microsoft Sentinel, Azure Data Explorer, and Azure Blob Storage.

Intelligent Data Routing

DataStream ensures that security-relevant data is routed efficiently to the right destination:

• Microsoft Sentinel: Receives high-priority and security-critical logs for detection and response.
• Azure Data Explorer: Stores logs used for threat hunting and security analytics.
• Azure Blob Storage: Archives logs required for compliance and long-term retention at a reduced cost.

Key Features

• Agentless Data Collection: Collects telemetry from servers, applications, network devices, and endpoints without requiring local agents.

• Automated Log Normalization: Converts CEF-formatted logs into Microsoft’s CommonSecurityLog (CSL) and ASIM-compliant formats.

• Threat Intelligence Enrichment: Adds contextual data to enhance detection and investigation.

• Log Filtering and Routing Policies: Reduces noisy or redundant data upstream, optimizing ingestion.

Benefits

Organizations using DataStream typically experience:

• 50% to 90% reduction in data volume ingested into SIEM.

• 25% to 75% reduction in manual data collection and processing efforts.

Enterprise-Grade Architecture

• Vectorized Pipeline: Built for scalable, high-throughput performance.

• Write-Ahead Log Architecture: Guarantees reliability and prevents data loss.

• Azure-Native Security: Uses Managed Identity for secure authentication and ensures data remains within your environment.