The Logmetry BlueprintPhase 01
Foundation. A complete engagement on its own.
Take control of your telemetry with a pipeline in front of every platform. Every source is cleaned, enriched and routed: the SIEM and APM get what they need with every alert kept, the sources you dropped for cost come back into coverage, the clean copy lands in a Lake ready for your AI SOC, and the full raw copy goes to an archive for audit.
What gets built
- A pipeline in front of your SIEM and APM, built as code
- Every event cleaned, deduplicated, masked and enriched in flight
- Each platform fed what it needs: every alert kept, more sources covered
- A clean Lake in your storage, ready for AI agents
- The full raw copy in an archive you own, for audit and replay
The gate
A valid place to stop. Phase 01 is a complete engagement on its own.
01The pipeline
One layer decides what each destination gets
The control layer sits between every source you have and every destination you pay for, and sends each one only what it reads: your detections keep firing on a fraction of the data, and nothing is lost, because the full copy lands in your Lake.
The event as it arrives, and as it leaves
- TimeCreated2026-09-24T14:02:11Z
- Computerweb-07.corp
- EventID4624
- TargetUserNamej.rivera
- IpAddress10.4.18.22
- LogonType3
- MessageAn account was successfully logged on…Trimmed for the SIEM: Repeats the fields above
- Keywords0x8020000000000000Trimmed for the SIEM: Never searched
- ProcessName-Trimmed for the SIEM: Empty
- owner_teamidentity-platformContext added: Who owns the host
- ip_scopeinternalContext added: Inside or outside
- serviceweb-frontendContext added: What it belongs to
To your SIEM
The fields detection reads, and nothing else.
EventIDTargetUserNameIpAddressLogonTypeip_scope
To your Lake
Every field, the message too, enriched and kept at full fidelity.
All twelve
To your agent
Each query reads only the fields an agent needs, from the Lake.
TargetUserNameip_scopeowner_teamservice
Illustrative, one Windows logon event. Your own sources are read in the review.
Collect once, route anywhere. Events are parsed, trimmed, and enriched with context in flight, so only real signal moves forward and every downstream consumer benefits from the same cleanup. Your detections keep firing and your dashboards keep working, on a fraction of the data.
It is also pipeline insurance. Your destinations will change. SIEMs get replaced, monitoring vendors get dropped, new tools arrive, and each of those used to mean re-collecting everything. With the control layer in place, a vendor change becomes a routing change, not a rebuild.
02The Lake
The asset that compounds
The byproduct of the control layer is a Lake in your own storage, under your keys, holding clean, normalized, enriched telemetry partitioned so search stays fast and cheap across years of history.
Not an export the vendor allows. Yours. The data in it carries context that never existed before: which team owns the subnet, whether the IP is internal or external, which service the host belongs to.
Every future consumer reads from this Lake. The next SIEM, an in-house platform, an AI agent, all of them start with clean history on day one instead of an empty index. Nothing in your telemetry estate is hostage to a vendor again.
03The archive
Full fidelity, mask at the source
Everything, not just what the SIEM keeps, lands in a compliance archive at full fidelity, with sensitive fields masked at the source so PII that never lands can never leak.
The archive is replayable at any time. An investigation needs six months of firewall history, an auditor asks for evidence, a regulator wants the original records, a new tool needs its history backfilled. Each of those is a query and a replay, not a forensic project.
It is built to support the obligations your organization already carries, including HIPAA, PCI, and the log-producibility requirements supervised institutions answer to. Your compliance program stays yours. We give it evidence on demand.
04Why first
Why the foundation has to come first
You cannot choose where telemetry lands, how much of it, or how clean, without owning the pipeline that shapes it.
The pipeline sends each platform only what it needs and the rest wherever you decide, including a platform you build yourself or with us. Every platform you run is being rebuilt around AI, and the agents you run next, in Phase 02, are only as good as the data they reach: clean, cheap to keep, and yours. Remediation follows in Phase 03, collecting once and the footprint in Phase 04.
A valid place to stop
After Phase 01 you own the pipeline, every routing decision, the Lake and the raw archive. Everything after it is a continuation, not an obligation.
05Questions
Asked about the foundation
Do we have to change our collection first?
No. Phase 01 starts with the forwarders and agents you already run, pointed at the pipeline instead of straight at the SIEM. Open collection on OpenTelemetry is part of Phase 04, the footprint, after the pipeline, the AI triage on top of it and remediation.
Who owns the Lake?
You do, in the most literal sense: your S3 or Azure Blob, under your keys. Not an export the vendor allows. The data in it is clean, normalized, enriched, and partitioned so search stays fast and cheap across years of history. Every future consumer starts with clean history instead of an empty index.
Is Phase 01 really a valid place to stop?
Yes, and we badge it that way on purpose. After Phase 01 you own the pipeline, every routing decision, the Lake and the raw archive, your SIEM receives only what earns its place, and every later phase is a continuation you can take or leave. Many estates stop here and are right to.
Where does each copy of our data go?
Three places, each for its job. The SIEM receives what detection reads. The Lake receives the cleaned, deduplicated, enriched copy for search and for AI agents. The archive receives the full raw copy, unchanged, for audit and replay. All three sit in accounts you own.
See your architecture drawn, with the costs, before you spend anything.
Our lead architects draw your SIEM feed from your diagrams: where the cost sits, what step one would change, and where it would not pay. If it pays, the next step is a two-week proof on your noisiest source.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing