Tenzir
What it is
Tenzir is a data pipeline engine for security teams that collect, transform, enrich, and route security telemetry. Its building blocks span collection, parsing, shaping, normalization, optimization, protection, enrichment, analysis, detection, storage, search, routing, and replay. It can map vendor fields to OCSF, ASIM, ECS, CIM, UDM, or a custom schema. Pipelines can discard unqueried data and deduplicate repeated events to reduce storage use and analyst noise. The Protect building block supports encryption, pseudonymization, anonymization, masking, salted hashes, redaction, and dropping fields. Its integrations directory lists 173 integrations, including Amazon S3, Amazon Security Lake, Amazon SQS, Azure Blob Storage, Azure Event Hubs, and ArcSight. Nodes run in the customer's environment; Community and Enterprise platforms are hosted by Tenzir in AWS in Europe. Sovereign supports a self-hosted platform and fully air-gapped deployments. Community costs nothing and includes 1 TB/day ingress, 1 TB edge storage, a Platform API, and community support.
For and against
For
- Maps vendor fields to several named schemas.
- Pipelines can deduplicate repeated events.
- Protect supports redaction and field dropping.
- Sovereign supports air-gapped deployments.
Against
- Community includes 1 TB/day ingress and 1 TB edge storage.
The verdict
Tenzir combines telemetry processing stages with schema mapping, data protection, and routing. Its deployment choices include customer-run nodes and, for Sovereign, a self-hosted platform.
Who it suits
Community is described for home labbers, researchers, and curious data hackers. Enterprise is aimed at enterprises and service partners, while Sovereign is intended for on-premises needs and service providers.
Plans and prices
Community
1 TB/day ingress · 1 TB edge storage · Platform API · Community Support
Read 4 Oct 2026 · tenzir.com
Enterprise
Licensed ingress volume · Unlimited edge storage · 1 organization · Unlimited workspaces
Read 4 Oct 2026 · tenzir.com
Sovereign
Licensed ingress volume · Unlimited edge storage · Unlimited organizations and workspaces · Self-hosted platform, including air-gapped deployments
Read 4 Oct 2026 · tenzir.com
On the record
- Air-gapped use
- The Sovereign Edition supports fully air-gapped environments.tenzir.com · read 4 Oct 2026
- Data protection
- The Protect building block supports encryption, pseudonymization, anonymization, masking, salted hashes, redaction, and dropping fields.tenzir.com · read 4 Oct 2026
- Data reduction
- Pipelines can drop unqueried data and deduplicate repeated events to reduce storage cost and analyst noise.tenzir.com · read 4 Oct 2026
- Deployment
- Tenzir nodes run in the customer's environment, while the Community and Enterprise platforms are hosted by Tenzir in AWS in Europe; Sovereign allows platform self-hosting.tenzir.com · read 4 Oct 2026
- Integration examples
- Available integrations include Amazon S3, Amazon Security Lake, Amazon SQS, Azure Blob Storage, Azure Event Hubs, and ArcSight.tenzir.com · read 4 Oct 2026
- Integrations
- The integrations directory lists 173 integrations and marks them as available or planned.tenzir.com · read 4 Oct 2026
- Intended users
- The pricing page describes Community for home labbers, researchers, and curious data hackers, Enterprise for enterprises and service partners, and Sovereign for on-premises needs and service providers.tenzir.com · read 4 Oct 2026
- Maker
- The maker is Tenzir GmbH, registered in Hamburg, Germany.tenzir.com · read 4 Oct 2026
- Normalization
- Tenzir can map vendor fields into OCSF, ASIM, ECS, CIM, UDM, or a custom schema.tenzir.com · read 4 Oct 2026
- Pipeline stages
- Its building blocks include collection, parsing, shaping, normalization, optimization, protection, enrichment, analysis, detection, storage, search, routing, and replay.tenzir.com · read 4 Oct 2026
- Security controls
- Enterprise includes external secrets, role-based access control, and audit logs; Sovereign adds a custom identity provider and self-hosted platform.tenzir.com · read 4 Oct 2026
- Support
- Community includes community support, Enterprise includes 24x7 support and SLAs, and Sovereign includes dedicated support.tenzir.com · read 4 Oct 2026
- What it does
- Tenzir is a data pipeline engine for security teams to collect, transform, enrich, and route security telemetry.tenzir.com · read 4 Oct 2026
