Security Data Layer Moves Threat Rules Ahead of Log Ingestion

New Platform Runs Sigma Rules Before Logs Reach the SIEM

Axoflow has introduced AxoDetect, a new security capability that runs Sigma detection rules directly within the data pipeline before security telemetry reaches a SIEM platform.

The company announced the product during Splunk .conf26 and said AxoDetect is currently available through an early-access program.

Alerts Move Forward, Raw Logs Stay Separate

The platform is designed to separate security analytics from expensive log ingestion.

AxoDetect evaluates normalized security data as it moves through the pipeline. Alerts can then be forwarded to the SIEM, while full-fidelity logs are stored in AxoLake, Axoflow's lower-cost security data lake, which can also operate on-premises.

This architecture is intended to reduce the amount of raw telemetry that organizations need to send into their SIEM while preserving access to the underlying data.

Sigma Provides the Detection Layer

Security teams can create, tune and reuse Sigma rules, allowing detection logic to remain in an open format rather than being tied to a particular security platform.

AxoDetect also provides visibility into which data sources support individual rules and where required telemetry is missing, according to the company.

Company Reports Lower Data and SIEM Costs

Axoflow says early deployments have produced significant reductions in infrastructure and SIEM expenses.

According to the company, one global industrial organization reduced its SIEM costs by 50% while cutting mean time to resolution by 85%. A government agency reportedly reduced its data volume by 80% and infrastructure footprint by 85%.
These figures are company-reported results rather than independently validated benchmarks.

SIEM Becomes More Focused on Analyst Workflows

The company argues that security teams do not necessarily need to eliminate their existing SIEM deployments. Instead, the platform is designed to reduce the amount of raw data sent to them.

Under the model, the SIEM can remain focused on analyst workflows and security operations, while collection, normalization, storage and rule evaluation happen earlier in the data path.

More Capabilities Are Planned

Axoflow said it plans to expand the platform toward a broader detection lifecycle operating directly where security data is processed.

The initial release, however, is centered on running Sigma rules in-stream and separating actionable alerts from the storage of full-fidelity telemetry.