Pipelines, scored. The technical winner isn't always the procurement-defensible default.

The scoring table — Archetype B

Same nine criteria, re-weighted. OCSF fidelity at 30, cross-source correlation at 15, lines-of-config at 15; that's 60% of the score on OCSF + correlation + expression.

Decision shape: what changes when OCSF carries 30 of 100

Tenzir's weighted total (3.70–3.90) is roughly equal to Archetype A's (3.75–3.95). What changes is its position in the ranking, not its absolute score. The +130 weighted points gained from OCSF + correlation under B are offset by ~135 lost on the two reduction ratios, pricing, lock-in, and resource. The weights moved between dimensions and Tenzir scored high on both ends, so net is roughly zero. Cribl drops harder because Pack-mediated OCSF normalization is scored 3 vs. Tenzir's 4 at the 30-weight criterion; that's a 30-point gap on a single criterion. Vector falls further still: its score-2 on OCSF at weight 30 is a 60-point gap to Tenzir, exposing the observability-generalist design as structural OCSF misfit for this archetype. The honest decision shape: run a source-coverage audit before committing. Does Cribl's Pack inventory map every one of your 10+ sources (CloudTrail, Zeek, EDR, identity, SaaS APIs) to OCSF with zero gaps? If yes, Cribl + route-by-fidelity is the procurement-defensible default. If gaps exist, Tenzir's OCSF-native path is materially stronger, and the gap-count drives the engagement scoping.

Where the ranking is fragile

The B ranking pivots on a Tier-A datapoint that doesn't exist yet: an independent OCSF lossiness audit for Tenzir at production scale (5+ TB/day). One pending caveat carried on the score itself: the 4 predates the first-party 2026-06-14 pipeline-normalization-fidelity measurement, which found Tenzir's shipped Zeek→OCSF mapping class-right (100% Network Activity) but activity-wrong (activity_id correct on 17%) with no shipped CloudTrail/Sysmon/auth mapping in the shape those sources actually emit, so the availability-vs-fidelity re-score is an open owner scoring decision. Per A-03-tenzir-ocsf-unaudited-at-scale, Tenzir's architecture is sound but unaudited at 5+ TB/day. If an audit shows > 10% lossiness on Zeek or CloudTrail or EDR mapping, the OCSF score drops from 4 to 3, the weighted total falls to ~3.40, and Cribl pulls roughly even on the procurement-defensible axis it already owns. Conversely, a clean lossiness audit at < 5% lifts Tenzir's score to 5 at weight 30 and the total climbs to ~4.00. At that point Cribl's Pack approach becomes hard to defend on technical grounds and the engagement reasoning shifts toward "use Cribl only when the Pack inventory exactly fits and the customer values GUI workflows."

Disclosure block. No active partnership disclosures among the four Archetype B candidates.

The 0.40-point gap between Tenzir and Cribl at Archetype A (and the 0.50-point gap at Archetype B) is real on every criterion the matrix scores directly. Tenzir's OCSF-native design, Apache 2.0 core, TQL expressiveness, and pipe-layer detection latency (15–50ms vs. 5–30s) are the architectural facts. I scored what I could measure. But the matrix is also showing an asymmetry it can't encode as a numeric score: production-evidence base. Cribl carries 50+ Fortune-100 production references (vendor-reported, anonymized — Tier B at best), RiverSafe's partner-published 40%-reduction measurement (Tier C, Cribl partner), Yale New Haven Health's 40% Sentinel reduction (a Cribl-published case study, Tier C), and TransUnion at scale. Tenzir's public customer count sits under 100 known deployments with no published Fortune-500 OCSF lossiness audit at 5+ TB/day; that's the A-03 gap.

The honest engagement framing: the matrix scores what's measurable; the procurement-defensibility finding is structural and lives in the qualitative notes. Per A-02-cribl-70-90-is-tuned-not-default, Cribl's marketed 70–90% headline is the aggressive-tuned ceiling, not the out-of-box default; the honest default is 30–50%. I've scored Cribl's default_reduction_ratio at 4 on that adjusted basis, with the shipped-vs-claim delta documented in the YAML. If the H1-COST-02 head-to-head benchmark ships ~Q1 2027 and anchors a Tier-A reduction-ratio measurement, both Tenzir and Cribl's scores on the dominant Archetype-A criterion move at the same time, and the procurement-defensibility framing changes shape with them. Until that benchmark lands, the recommendation pattern is: Cribl is the default for regulated industries where Tier-A practice references gate procurement; Tenzir is the upgrade path when the four conditions in the Archetype A decision shape hold simultaneously.

This is what fair-broker scoring looks like when the matrix and the qualitative finding disagree. I don't collapse them. The matrix tells customers what the criteria say; the qualitative finding tells customers what the procurement committee will say; both are the deliverable.

The pipeline choice depends on the foundation pattern (C0: isolated dedicated vs. shared corporate vs. MSSP), the format and catalog choice (C1+C2: Iceberg+Glue vs. Iceberg+Polaris vs. Delta+Unity), and the visualization tier (C5: Splunk SH federated vs. Grafana on ClickHouse vs. vendor SOC UI). The coupling that matters most for the C4 decision: OCSF normalization can happen at C4 (Tenzir native, Cribl via Packs, Vector via custom VRL) or at C3 query-time (raw events stored, OCSF applied at read via schema-on-read). Both work; the cost shifts. Schema-on-write at C4 trades ingest CPU for query simplicity downstream. Schema-on-read at C3 trades ingest simplicity for query CPU and schema governance discipline.

Cribl's Cribl Search product hints at a third option (schema-on-read at the pipeline layer with operators dispatched against S3-resident raw events), but the Cribl Search architecture requires Iceberg/Delta on S3 and is AWS-aligned, so it interacts with the C0+C1+C2 cascade rather than sitting orthogonal to it. The engagement deliverable scopes the C4 decision against the C0–C2 decisions that have already been made; reversing the order produces churn.

Two caveats worth carrying across that C4/C3 boundary. First, whichever side carries the normalization, it's scored on two levels in order, because the first binds before the second matters. Availability comes first — does the tool ship a usable mapping for the source at all, in the shape the client's actual shipper emits — and first-party pipeline-fidelity work (Tier B, single host, OCSF 1.8.0, version-bound; sdw-lab-benchmarks/pipeline-normalization-fidelity/FINDINGS-2026-06-14.md) found shipped-mapping availability, not per-field fidelity, to be the binding constraint across the open tools tested, with several common security sources having no usable shipped mapping at all, or one bound to a raw input shape (EVTX/XML) that pre-parsed EDR JSON doesn't match. Fidelity comes second, and the gap there is that a shipped mapping can get the OCSF class right and most field values right while still getting the activity classification wrong — "maps to OCSF" is a coverage claim, not a fidelity guarantee, and the part that fails is often the part detection content keys on.

Second, if the C3 side leans on MV-like acceleration (semantic-layer / MV-style transparent query rewrite) to absorb the schema-on-read query cost, remember that it does not move the concurrency knee: the StarRocks-MV upper-bound arm hit the knee at the same ~64× as base StarRocks (2026-06-14 workload-interference bench). "Faster query" is not "helps under load," and materialized views are not a substitute for a concurrency plan.