What you runRunning a data lake?
Not a dump. A Lake built for AI queries.
We control what your Lake looks like: cleaned and deduplicated on the way in, enriched with full context, partitioned into tables shaped for the questions your agents and analysts ask, on open table formats. Every query reads less, costs fewer tokens, and correlates across every source.
Free. No system access. No obligation. You keep the drawing.
Where the meter sits
A lake is billed as storage plus what each query scans. The meters that hurt are the tools that still receive everything beside it.
01Where a lake stops short
Dumping everything into a lake is not the answer.
A lake is already the cheap place to keep data, so the problem is not the bill. It is what goes in and how it is read: a dump of raw duplicates helps nobody, while a clean Lake beside a raw archive serves the auditor and the agent.
“We send everything to the lake, and nobody can find anything in it.”
A deduplicated Lake, not a dump. Cleaned, enriched and partitioned on the way in.
- Why it happens
Raw data written as it arrives, duplicated, unenriched and unpartitioned, makes every search a full scan and every investigation an export job. Storage is cheap. Finding something in it is not.
- What changes
A pipeline cleans and deduplicates each source before it lands, adds context at write time, and partitions the Lake the way investigations move: by time, by entity, by source.
- How sure you can be
The raw copy is kept separately, unchanged, so cleaning the Lake never costs you evidence.
- How soon
With the first source that lands clean.
- What it takes from you
Your storage account, your query engine, and one call.
What the Lake becomes
- DeduplicatedEach event once, not once per tool that collected it.
- Enriched at write timeOwner, service, asset value and context in the record.
- Partitioned for retrievalA year of history back in seconds, not an overnight scan.
- Open table formatsReadable by the engine you use today and the model you use next year.
“Our lake is our audit archive and our AI data, and it does neither job well.”
Two copies, each for its job. Raw for the auditor, clean for the agent.
- Why it happens
Auditors need every raw byte, unchanged and retained. Agents need clean, deduplicated, enriched events. One bucket of raw data serves the auditor and starves the agent.
- What changes
The pipeline writes the full raw copy to an archive in your account for audit and replay, and the cleaned copy to the Lake for search and agents. The SIEM receives only what detection reads.
- How sure you can be
Both copies sit in your accounts, under your keys and your retention rules.
- How soon
From the first source.
- What it takes from you
Your retention rules and your auditors’ questions.
Where each copy goes
- Raw eventsToday: Mixed into the lakeWith you in control: An archive in your account, for audit and replay
- Clean eventsToday: Never producedWith you in control: The Lake, deduplicated and enriched
- Detection dataToday: Everything, to the SIEM tooWith you in control: The SIEM, only what it reads
“We built the lake for AI, and our agents can’t make sense of it.”
Your agents, on your data, following your runbooks. Not one more module on their price list.
- Why it happens
Raw, unenriched data makes an agent spend its effort parsing instead of reasoning. The lake has the data and not the context.
- What changes
Enrichment lands context at write time, events are trimmed to only the fields an agent needs, partitioning follows investigations, and your agent reads the Lake as its working memory.
- How sure you can be
Agents reason well on clean, trimmed data and badly on noise. Knowing which fields matter takes understanding machine data, source by source, and that is the work we do.
- How soon
As soon as the first sources land clean in your Lake, your agent has something worth reading.
- What it takes from you
Your runbooks, or we write them with you. The agents, prompts and runbooks are code you own.
What you get running
- Agents you control, in your accountThey run where your data is, under your access rules.
- Models you choose, and swapSmall or open-weight models for routine alerts, larger ones for investigations. Changing one is a config change, not a renewal.
- Your runbooks, as codeVersioned in your repositories. The agent follows them step by step.
- Token controlFields trimmed in flight to what the agent needs, so every query reads less and costs less.
- Fixes as pull requestsThe agent writes the fix, a person approves it, and remediation moves at the speed of a review.
- A Lake anyone can queryDevelopers and stakeholders ask the clean Lake directly, at object-storage prices.
“Our history is ours, and our investigations still happen in the vendor’s tool.”
Make the Lake the place questions get answered. Every tool becomes a choice.
- Why it happens
History nobody can query does not reduce dependence on the tool that can. The vendors now sell cheaper lakes of their own, in their format, read by their tools.
- What changes
Open table formats, partitioning and enrichment make your Lake readable by any engine, so swapping a tool becomes a routing change.
- How sure you can be
The detections, dashboards and alerts your team relies on keep firing where they do today. A move becomes a parallel run on the same routed feed, proven before anything is retired.
- How soon
Before your next renewal, if we start with the sources that drive it.
- What it takes from you
Your diagrams, your renewal date, and one call.
Your way out
- MigrationToday: Quarters of overlapping licensesWith you in control: Weeks: a parallel run, then a routing change
- Your dataToday: Their format, in their storeWith you in control: Open schemas, OCSF and OpenTelemetry, in your Lake
- HistoryToday: Stays behind when you leaveWith you in control: Replays into any tool you choose
- Collection and fleetToday: Their agents, their consoleWith you in control: A control layer and fleet plane you own
02Today, and after
Today, and with the Blueprint
A lake that stores telemetry raw and unpartitioned answers no questions: every search is a scan, every investigation an export job, and the expensive tools still receive everything.
Scroll the drawing sideways to see all of it.
What a lake does best
If telemetry already lands in your own storage, you got the most important decision right: history in a place you control, at object-storage cost, outside any vendor's retention math. That position compounds, and it is the asset every AI ambition in this market ultimately stands on.
The catch is that raw storage answers no questions. Data written as it arrived, unenriched and unpartitioned, makes every search a scan and every investigation an export job. The lake most estates have is an archive. The Lake the Blueprint builds is a working asset: enriched in flight, partitioned the way investigations move, held on open table formats so every engine and every model can read it.
How it works, and where we sit
A telemetry lake is object storage you own, holding logs, metrics, and traces as Parquet on open table formats like Iceberg, queried by any engine and priced at storage plus what each query scans rather than per GB ingested. It never fires an alert, because detection belongs in the real-time store, and it pays off only when the data in it is enriched, partitioned the way investigations move, and read by an agent. Until then it is cheap storage nobody opens.
03The five verbs
What we keep, and what changes
Keep it and govern what flows in, shrink its footprint, cut what it costs, extend it with an agent, and replace only where replacement is honest.
- Keep
Your storage, your keys, your history. Nothing moves out. The lake you built is the right foundation.
- Shrink
What still flows to expensive destinations gets governed by the control layer, now that there is a credible cheap path beside them that keeps every byte replayable on demand.
- Cut
Retrieval cost collapses when partitioning matches how queries actually move: by time, by entity, by source.
- Extend
Enrichment lands context at write time, compliance replay becomes a query, and the agent phases read the Lake as their working memory.
- Replace
Nothing. This page is about making an asset you already own start paying.
The letters mark where each verb acts in the drawing with the Blueprint.
From archive to working asset
The difference between an archive and an asset is enrichment at write time, partitioning for retrieval, and open table formats every future reader can use.
Events land carrying context that never existed before: which team owns the subnet, whether the IP is internal or external, which service the host belongs to. Partitioning follows investigation patterns so a year of history comes back in seconds. Open table formats keep the data readable by the query engine you use today and the model you point at it next year.
Then the agent phases put it to work: triage and root cause reading full-fidelity history, and the hunt across everything nobody thought to alert on.
04The free architecture review
We draw your architecture, free. Today, after, and what it costs.
Telemetry engineers look at your whole environment and show you exactly where the cost, the waste and the hurdles are, and what your architecture could look like. No strings attached.
What you get
- Your architecture today, drawnEvery source, pipeline and destination, as it actually flows.
- The waste mapWhere you pay for data nobody reads, and what it costs you each year.
- Costs before and after, with estimatesWhat you spend now, and what the same coverage would cost.
- Your target architectureWhat your estate could look like, drawn on your own sources.
- Options for your business problemNot one product. The choices, with what each one costs and changes.
Who does it
A lead architect with 26 years in monitoring and observability, leading a team of senior engineers in telemetry engineering and pipeline design. The team that reviews it is the team that would build it.
What it takes from you
Your diagrams and one call. No system access.
What comes next
If it pays, a two-week proof of value on your noisiest source, free unless you go ahead. At least 20% less into your SIEM, every alert kept, proved on your data.
What it costs
Nothing
No strings attached. You keep the drawing, whatever you decide.
05Questions
What data lake teams ask before they book
We already store everything in S3. Is that not enough?
Storage is the prerequisite, not the payoff. Unenriched, unpartitioned data makes every question an export job, so nobody asks. Enrichment, partitioning, and open table formats are what turn kept data into answered questions, and they are retrofittable onto the lake you have.
Which table format do you build on?
Open ones, with Iceberg as the direction the market has chosen. The specific layout follows your query engines and your cloud in the review. The principle does not move: no format a single vendor controls gets to hold your history.
Can the Lake replace our SIEM?
No, and we will not pitch that. The Lake never alerts. Detection stays on the SIEM, which is built for it. The Lake holds the full-fidelity history the SIEM should not have to, serves compliance and investigations, and feeds the agents. Each layer does the job it is priced for. What the Lake does change is the lock-in: with your history in your own storage, swapping the SIEM becomes a routing change.
Why is the review free?
Because the drawing is how you judge us. You see your own architecture, your waste and your options before you spend anything, and you keep the drawing whatever you decide. No system access, no obligation.
Are you a reseller for a vendor?
Yes, for certain vendors’ software. We are also the delivery partner and integrator on custom projects, directly or alongside your systems integrator. The pipeline subscription is in your name, bought from the vendor, its channel or through Logmetry where we resell it, and priced on its own line. We recommend what fits your business problem, even when that means changing nothing, and no SIEM or APM vendor pays us to recommend it.
What if the savings don’t hold on our data?
You see it measured before you commit. The two-week proof of value runs on your noisiest source, with success criteria signed before it starts, measured in your SIEM’s own license usage view. At least 20% less into your SIEM, every alert kept, proved on your data.
See your data lake drawn, with the costs, before you spend anything
Run by a lead architect with 26 years in monitoring and observability. No system access, no charge, no obligation.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing