Tenzir is a data pipeline engine for security teams — written in C++ and released under the BSD-3-Clause licence — that lets SOC analysts, detection engineers, and incident responders collect, transform, enrich, and route security telemetry instead of only storing it.

What it is

Tenzir lives in the security data operations space, filed in this registry under Security & Privacy / Threat Detection & Response, and its topic tags place it alongside SIEM, SOC, and incident-response tooling. At its core it is a pipeline engine: pipelines manage dataflows, and those dataflows cover the full span of collect, parse, shape, normalize, aggregate, store, query, and route. It is implemented in C++, and the project describes itself as built for security telemetry data at scale.

The concrete problem it solves is telemetry handling that has outgrown ad-hoc scripts and store-everything-then-query habits. Tenzir makes it easier to onboard and store data from numerous sources, to reduce data volumes so that cloud and data costs stay under control, and to execute detections and run analytics in-stream rather than after the data has landed somewhere expensive. The README does not name a specific product that Tenzir replaces; it describes the set of tasks — ingestion, normalization, volume reduction, in-stream detection — that it absorbs into one engine.

Key capabilities

• One pipeline engine covering collect, parse, shape, normalize, aggregate, store, query, and route for security telemetry.
• In-stream detection and analytics, so detections run as data flows through the pipeline instead of after storage.
• Data volume reduction aimed at optimizing cloud and data costs.
• Onboarding and storage of data from numerous sources.
• Implemented in C++, per the repository language field.
• Released under the permissive BSD-3-Clause licence.
• Registry topics span netflow, pcap, sigma, siem, sou, incident-response, investigation, secdataops, and dataops, indicating coverage of network telemetry and detection workflows.

Who uses it and how

• SOC teams that need to normalize and route telemetry from many sources into a consistent shape before storage.
• Incident responders and investigation teams, reflected in the incident-response and investigation topics.
• secdataops and dataops engineers who build and maintain telemetry pipelines as ongoing infrastructure.
• Cost-conscious teams that reduce telemetry volume before it reaches cloud storage.
• Detection engineering teams whose toolchains involve Siemens-style rule content, indicated by the sigma topic.

Getting started

The README points to the documentation at https://docs.tenzir.com, which carries tutorials that walk through first steps, how-to guides for specific problems, explanations of key concepts, and an in-depth technical reference. The README does not give a package name, Docker image, or compose file, so the documented tutorials are the stated entry point.

How it compares

No list of paid products is given in these facts, and no similar open-source tool is named either. Tenzir therefore stands alone in this registry, with only the SIEM, SOC, and netflow topic tags indicating the neighbourhood it belongs to.

When to use it — and when not to

Pick Tenzir when the work is genuinely pipeline-shaped: many sources, normalization, volume reduction, and detection while data is still in flight. Be aware that the README is sparse — it lists no install command, no configuration example, and no version or release information — so all practical setup detail lives in the external documentation, and any deployment dependencies are unstated here. Teams that want a fully hosted, turnkey service, or that need a documented plugin ecosystem before adopting, should look elsewhere; the repository shows 758 stars, 109 forks, and 0 open issues, which is a healthy but not large footprint.