An open source data pipeline engine for security teams, collecting, transforming, storing and querying telemetry with a purpose built pipeline language.
Tenzir is an open source data pipeline engine for security teams. It collects, parses, normalises, enriches, reduces, stores and routes security telemetry such as logs and events, and lets you query it with TQL, a purpose built pipeline language, using the same syntax for both live streaming and historical analysis. Each node ships a built in columnar edge storage engine, so you can import events into the node and query them back without any external database.
It suits security and platform teams that want a self hosted pipeline to onboard telemetry from many sources, shape and reduce it to cut downstream storage and SIEM costs, and run detections and analytics in stream, all inside their own cloud account rather than through a managed service.
cloudimg delivers the open source Tenzir node hardened, fully patched and preconfigured, so the pipeline engine is running and ready to ingest and query the moment the instance boots. This is the standalone open source node, not the commercial platform: it needs no token and no subscription, and it makes no outbound connection to any management service. The node control endpoint is bound to loopback only and is protected by a start time guard that refuses to run it on any non loopback address, so nothing is exposed beyond SSH. The columnar store ships empty, and the image includes a one command self test that imports events and queries them back so you can confirm the engine end to end. The paired deployment guide walks through writing your first TQL pipelines, and every deployment carries 24/7 support.