Services
Security data
Where security telemetry lives, how it is shaped, and how cheaply you can keep it.
Store it once, search it cheaply.
Raw telemetry belongs in low-cost storage with long retention. Expensive search and alerting are for the slice of data that needs them, and that split is decided by how you investigate, not by a vendor price sheet.
ClickHouse
Schemas, ingestion from S3, retention tiers and investigation queries for high-volume security logs.
Read the full service page →Elasticsearch
Index design, ILM, ingest pipelines and cost control for security workloads.
OpenSearch
Self-managed or AWS-managed clusters sized and tuned for log retention and search.
OCSF
Mapping sources such as CloudTrail, Falco and Tetragon into OCSF, plus validation and storage design.
Kafka and MSK
A durable middle layer when several consumers need the same security stream.