Intelligent data pipeline for Google SecOps

Bindplane handles basic log collection and forwarding – it’s useful for getting data into Google SecOps, but it doesn’t perform deterministic UDM normalization, schema governance, or multi-destination routing based on security value. DataStream operates as a full pipeline layer before data reaches SecOps: it normalizes logs from any source to UDM using vendor-specific parsers, validates schema before ingestion to eliminate parser drift, reduces ingest volume by 50–90%, and simultaneously routes data to Google SecOps, BigQuery, and Cloud Storage from a single pipeline. For enterprises with diverse source environments and cost control requirements, DataStream does what Bindplane alone cannot. 

Google SecOps uses the Unified Data Model (UDM) to standardize security telemetry across log sources so that detection rules and threat hunting queries work consistently across all data. Traditionally, this requires writing and maintaining custom parsers – a process that breaks every time a vendor changes their log format. DataStream handles UDM mapping automatically: vendor-specific pipeline templates map source fields to UDM equivalents at ingest time, covering Windows events, Linux syslog, network devices, and 30+ security vendors. No manual parser writing is required for supported sources, and schema drift is detected in real time before it affects your detection rules. 

DataStream supports both agentless and agent-based collection. Agentless collection connects directly via WinRM (Windows) or SSH (Linux, macOS, Solaris, AIX) with no software installation. For network devices, OT/ICS systems, and security appliances, DataStream collects via Syslog and REST APIs, and supports standard log formats including CEF and LEEF. Pre-built pipeline templates cover major security vendors: Fortinet, Palo Alto Networks, Check Point, Cisco, CrowdStrike, and more. For sources without native SecOps parser support, custom log type definitions ensure logs are stored and routed correctly without requiring a custom Google SecOps parser. 

DataStream applies policy-based redaction and masking in the pipeline before data leaves your environment. You define rules through a no-code UI to automatically remove or obfuscate sensitive fields: usernames, passwords, tokens, PII such as email addresses and phone numbers, or any custom field. Redaction is applied consistently across all incoming data, and the structure and security context of each log remain intact, so detection rules continue to work accurately. Policies are designed to support GDPR, HIPAA, and PCI DSS requirements, and redacted pipelines are audit-ready. 

Yes, multi-destination routing is a core capability. DataStream can simultaneously send UDM-normalized security events to Google SecOps for real-time threat detection; full data volume to a data lake for mid-term retention; and raw logs in Parquet format to Google Cloud Storage, AWS S3, or Azure Blob Storage for long-term archival at a fraction of SecOps ingest cost. Each destination receives the appropriate data tier based on security value, with a Correlation ID linking optimized SecOps data back to complete raw logs in archive storage for forensic investigations. 

Initial deployment takes under 30 minutes. DataStream’s guided setup handles authentication, regional endpoint selection, and pipeline configuration automatically, no manual Google Cloud infrastructure setup is required. A live demo by our solution engineer shows complete integration in 13 minutes. Watch it on YouTube.