Tenzir on Ubuntu 24.04

Azure Security

An open source data pipeline engine for security teams, collecting, transforming, storing and querying telemetry with a purpose built pipeline language.

Base
Hardened build
minimal ports, security patches applied at build time
Access
Unique credentials
generated on first boot, readable only by root
Verified
Boots working
services pass a health gate before release
Support
24/7, 365 days
by email and live chat, 24 hour response SLA

Overview

Tenzir is an open source data pipeline engine for security teams. It collects, parses, normalises, enriches, reduces, stores and routes security telemetry such as logs and events, and lets you query it with TQL, a purpose built pipeline language, using the same syntax for both live streaming and historical analysis. Each node ships a built in columnar edge storage engine, so you can import events into the node and query them back without any external database.

It suits security and platform teams that want a self hosted pipeline to onboard telemetry from many sources, shape and reduce it to cut downstream storage and SIEM costs, and run detections and analytics in stream, all inside their own cloud account rather than through a managed service.

Why the cloudimg image

cloudimg delivers the open source Tenzir node hardened, fully patched and preconfigured, so the pipeline engine is running and ready to ingest and query the moment the instance boots. This is the standalone open source node, not the commercial platform: it needs no token and no subscription, and it makes no outbound connection to any management service. The node control endpoint is bound to loopback only and is protected by a start time guard that refuses to run it on any non loopback address, so nothing is exposed beyond SSH. The columnar store ships empty, and the image includes a one command self test that imports events and queries them back so you can confirm the engine end to end. The paired deployment guide walks through writing your first TQL pipelines, and every deployment carries 24/7 support.

Common uses

  • Collect, shape and reduce security telemetry before it reaches your SIEM
  • Store events in the node and query them with TQL for detections and hunting
  • Route and normalise logs across many sources from one self hosted pipeline