Benefits
Supercharge your SOC team
For whom
Built to empower every role
Use cases
Collection
Get clean telemetry without agents
DataStream collects telemetry directly from many sources with out-of-the-box vendor packs, using secure connections like WinRM and SSH with read-only access. No agents, complex setups, configuring, or system restarts required. Data is categorized at the source, giving you a consistent structure and built-in compliance.
Normalization
Normalize logs into one schema
DataStream automatically parses raw logs, normalizes them into a consistent schema, and converts formats like CEF, LEEF, JSON, OCSF into a unified structure. Without manual parsing, custom scripts, or field mapping. You get clean, structured data that your SIEM can understand making rules sharper, correlations stronger, and threat detection more reliable.
Filtering & reduction
Eliminate noise, keep the insight
DataStream’s Smart Engine reads your detection rules and keeps every field and event they use. Everything else is dropped before ingestion, cutting volume by up to 90% and higher. Teams that want manual control can configure field-level and event-level reduction instead. They remove redundant fields and filter events by criteria such as Event ID, IP address or user activity.
Enrichment
Add the missing context
Logs alone show events, but not the context. DataStream enriches telemetry automatically, adding details that align with your security policies: user identities, geo-location, device and application data, or custom tags. Instead of flat events, your SOC receives complete insights that make alerts more precise, reduce false positives, and speed up investigations.
Routing
Deliver data where it matters
Not all telemetry belongs in your SIEM. Some need to go to storage for compliance, some to analytics platforms, and some straight into SIEM for real-time detection. DataStream makes this seamless with intelligent routing. Context-aware filters ensure that only meaningful events hit SIEM, while less critical logs can be directed to other platforms – all in parallel.
Features
10x faster data processing
The vectorized pipeline engine utilizes all CPU cores for parallel batch processing, delivering industry-leading performance. VMF 3.0 format achieves 99% compression and delivers extra features like Bloom Filters or LogChain.
Zero security data loss
Advanced Write-Ahead Log technology ensures full data integrity with minimal duplication, even during interruptions. Built-in crash recovery removes the need for external systems like Kafka while maintaining reliable processing.
Extensive processor support
DataStream adopts the Elastic Ingest Pipeline syntax, but provides 220+ processors, offering the industry’s most comprehensive low/no-code pipeline management. Complex pipelines can be built and optimized in minutes.
Correlation ID for unified visibility
DataStream assigns a unique Correlation ID to each log, linking related events across SIEM and other platforms. This makes it easy to trace activity, connect signals, and see the full picture in seconds.
Datastream is available in Microsoft Security Store
DataStream is certified and listed in Microsoft Security Store ensuring compliance, security, and faster time-to-value.
Frequently asked questions
What deployment options are available?
DataStream runs as Directors inside your environment, managed from the VirtualMetric cloud console. You choose how Directors run: self-managed on your own hosts, managed by VirtualMetric (Enterprise), or orchestrated in auto-scaling cloud environments. Serverless Directors run on Docker, Kubernetes, Azure Container Instances or Azure Container Apps. Self-managed Directors also support air-gapped networks. Directors are installed standalone or, on the Enterprise plan, as a cluster of three or more with automatic failover. Log data stays in your environment in every model, and only configuration and metadata sync to the cloud.
How fast can we deploy DataStream?
DataStream is fully agentless and can be deployed in under 30 minutes. With Single Sign-On for Microsoft Azure, out-of-the-box vendor packs, and a drag-and-drop interface, creating pipelines is quick and intuitive.
Does DataStream integrate with our existing tools?
Yes. DataStream supports all widely used operating systems and platforms out of the box, with vendor packs for common sources. It routes clean, normalized data to SIEMs, analytics platforms, storage systems or all at once.
How does DataStream support compliance requirements?
DataStream delivers normalized logs, automatically categorized into datasets for easier compliance and reporting. Audit-ready retention ensures timestamp integrity and zero-loss architecture. And with SOC 2 and ISO 27001 certification, you can trust your data is managed to the highest security standards.
Talk to our experts
Schedule a technical session with our engineering team to explore DataStream’s architecture, deployment options, and integration capabilities.
Try DataStream
Test DataStream’s vectorized pipeline with your SIEM environment. Process terabytes of data with 99% compression while maintaining complete security visibility.
Try now