Benefits
Supercharge your SOC team
For whom
Built to empower every role
Use cases
Collection
Collect clean telemetry, agentless or with an agent
DataStream collects telemetry from many sources with out-of-the-box content packs. Connect agentlessly with read-only access, or install a lightweight agent when necessary. Collection rules are defined once for each device role and apply across your whole fleet. Every device in scope collects the same logs, with no collection gaps at audit time.
Normalization
Normalize logs to each destination’s schema
DataStream parses raw logs and normalizes them to the schema each destination expects, with no manual parsing or field mapping. When data goes to several destinations, each one receives it in its own schema, so detection rules and queries run on the fields they were written for.
Filtering & reduction
Eliminate noise, keep the insight
DataStream’s Smart Engine reads your detection rules and keeps every field and event they use. Everything else is dropped before ingestion, cutting volume by up to 90% and higher. Teams that want manual control can configure field-level and event-level reduction instead. They remove redundant fields and filter events by criteria such as Event ID, IP address or user activity.
Enrichment
Add the missing context
Logs alone show events, but not the context. DataStream enriches telemetry automatically, adding details that align with your security policies: user identities, geo-location, device and application data, or custom tags. Instead of flat events, your SOC receives complete insights that make alerts more precise, reduce false positives, and speed up investigations.
Routing
Deliver data where it matters
Not all telemetry belongs in your SIEM. Some need to go to storage for compliance, some to analytics platforms, and some straight into SIEM for real-time detection. DataStream makes this seamless with intelligent routing. Context-aware filters ensure that only meaningful events hit SIEM, while less critical logs can be directed to other platforms – all in parallel.
Features
10x faster data processing
The vectorized pipeline engine utilizes all CPU cores for parallel batch processing, delivering industry-leading performance. VMF 3.0 format achieves 99% compression and delivers extra features like Bloom Filters or LogChain.
Zero security data loss
Advanced Write-Ahead Log technology ensures full data integrity with minimal duplication, even during interruptions. Built-in crash recovery removes the need for external systems like Kafka while maintaining reliable processing.
Extensive processor support
DataStream adopts the Elastic Ingest Pipeline syntax, but provides 220+ processors, offering the industry’s most comprehensive low/no-code pipeline management. Complex pipelines can be built and optimized in minutes.
Correlation ID for unified visibility
DataStream assigns a unique Correlation ID to each log, linking related events across SIEM and other platforms. This makes it easy to trace activity, connect signals, and see the full picture in seconds.
AI-assisted pipeline authoring
Connect Claude Code or another MCP-compatible coding agent to the DataStream MCP server. Your assistant tests and converts the pipelines it writes against the real DataStream engine, so the output matches what runs in production. The server has no access to your deployment or live data.
Test every change before it goes live
Run sample or live logs through a pipeline and see what each processor changes. Before you apply a pipeline, you can estimate how much each processor reduces the data. Unit tests, review before merge and staged rollouts keep untested changes away from production.
Datastream is available in Microsoft Security Store
DataStream is certified and listed in Microsoft Security Store ensuring compliance, security, and faster time-to-value.
Frequently asked questions
What deployment options are available?
DataStream runs as Directors, processing nodes inside your environment, managed from the VirtualMetric cloud console. On every plan, Directors can be managed by VirtualMetric or run serverless on Docker, Kubernetes, Azure Container Instances or Azure Container Apps. Enterprise adds self-managed Directors on your own hosts, including air-gapped networks, orchestrated Directors in auto-scaling cloud environments, and clusters of three or more Directors with automatic failover. Log data stays in your environment in every model, and only configuration and metadata sync to the cloud.
How fast can we deploy DataStream?
DataStream can be deployed in under 30 minutes, agentless or with a lightweight agent. With Single Sign-On for Microsoft Azure, out-of-the-box content packs, and a drag-and-drop interface, creating pipelines is quick and intuitive.
Does DataStream integrate with our existing tools?
Yes. DataStream supports all widely used operating systems and platforms out of the box, with content packs for common sources. It routes clean, normalized data to SIEMs, analytics platforms, storage systems or all at once.
How does DataStream support compliance requirements?
DataStream delivers normalized logs and applies the same collection rules to every device in scope, so there are no collection gaps at audit time. Audit-ready retention ensures timestamp integrity and zero-loss architecture. And with SOC 2 and ISO 27001 certification, you can trust your data is managed to the highest security standards.
Talk to our experts
Schedule a technical session with our engineering team to explore DataStream’s architecture, deployment options, and integration capabilities.
Try DataStream
Test DataStream’s vectorized pipeline with your SIEM environment. Process terabytes of data with 99% compression while maintaining complete security visibility.
Try now