The challenge
Remove friction from telemetry collection
SOC and infrastructure teams are stuck endlessly deploying and maintaining agents across thousands of systems, patching, updating, and troubleshooting them. Add to that fragmented tools, inconsistent formats, and credential sprawl, and what should be simple data collection turns into an expensive, error-prone bottleneck.
The Solution
DataStream – intelligent security data pipeline platform
Get clean telemetry in minutes
DataStream connects directly to 300+ sources to gather security data safely and reliably. Collect agentlessly or with a lightweight agent, with no system restarts or complicated setup, because everything works out of the box.
Start fast, stay simple
Agentless collection leaves nothing to patch or update on endpoints. Where you choose agents, enrollment templates speed up rollout across your systems. Secure integration with your existing systems makes setup fast and easy while keeping your environment protected.
One set of collection rules for your whole fleet
Define what to collect once for each device role and apply it across your fleet. Change a rule in one place and every assigned device follows. To onboard a new device, assign it the relevant setup and it starts collecting right away.
Key benefits
Why this approach works
Supported environments
One platform, no puzzle to assemble
You don’t need a patchwork of third-party collectors or separate “ingest tools.” Agentless and agent-based collection are both built in, so you aren’t stitching together (and maintaining) multiple components to get data flowing.
Frequently asked questions
Do we need to deploy endpoint agents?
No, deploying an agent is not the only way to collect data. DataStream supports both agent-based and agentless deployment models. For environments where installing agents is not preferred, you can use our agentless option, which leverages secure, read-only access over WinRM/SSH and native system logging facilities. This gives you full flexibility to choose the collection method that best fits your infrastructure and security requirements. Where you choose agents, enrollment templates speed up rollout across your systems.
How are credentials handled?
Device and target settings can hold credentials directly or reference a secret stored in Vault. The built-in VirtualMetric Vault keeps secrets encrypted at rest with AES-256-GCM. On Enterprise, secrets can also come from Azure Key Vault, CyberArk Central Credential Provider or HashiCorp Vault, so the value stays in your own vault. When you rotate a secret in Vault, every device and target that references it picks up the new value, and each secret keeps its own activity log. Windows collection can use Active Directory service accounts over WinRM, and Linux collection uses SSH key-based authentication, ensuring a secure, password-less connection.
How do we apply the same collection rules across hundreds of servers?
Create a dataset for each collection rule, for example the Windows Security log or a Linux file log. Group the datasets for one server role into a profile, such as domain controller or Linux web server, and assign it to every server in that role. When you edit a dataset, every device it is assigned to picks up the change. Datasets are available for Windows, WEC, Linux, Solaris, AIX, macOS, SQL Server, MySQL, PostgreSQL and Oracle. You can clone a dataset or profile to build a variant. You can also set either one to passive, which stops applying it and keeps its configuration.
Will collection impact system performance?
Collection uses native interfaces with a minimal footprint and read-only permissions.
Can DataStream run honeypots?
Yes. Alongside collecting from your own systems, DataStream can run decoy services that emulate SSH, RDP, SMB, Kerberos, LDAP, databases and other protocols. A honeypot is set up and managed like any other device. Every connection attempt it receives is logged and passed through the same pipelines and routes as the rest of your data.
Get DataStream in Microsoft Security Store
Deploy DataStream in minutes with Azure Managed Identity support built in. No credential management, no manual setup.