Component references
One engine, isolated.
A component reference takes a single engine or store and answers the architect’s real questions: what it does, where it sits in the pipeline, what it composes with, and what breaks at scale. The surrounding pipeline is generic scaffolding — the accented step is the component the pattern is organized around. Not a full architecture; a building block.
Component reference
Dremio — semantic layer + Reflections
Engine-anchored architecture for organizations with mixed BI and security analytics on shared Iceberg data. Reflections pre-materialize the hot paths; the…
Read the breakdown →
Component reference
3.6×
Trino — federation breadth
Engine-anchored architecture for multi-region, multi-platform SOCs that cannot, or should not, centralize all data into one store. Federate first, then query…
Read the breakdown →
Component reference
<100ms
RisingWave — streaming threat detection
Engine-anchored architecture for SOCs that cannot afford batch latency. PostgreSQL-compatible streaming database; continuous SQL computation over Kafka and CDC…
Read the breakdown →
Component reference
40%
Cribl Search — query in place, never rehydrate
Engine-anchored architecture that queries telemetry directly in cheap object storage. Cribl Stream writes Parquet partitioned by date and source; Cribl Search…
Read the breakdown →
Component reference
$3.04K/mo
StarRocks + ClickHouse — engine specialization
Two engines reading the same Iceberg data, each pinned to the workload it measurably wins on. ClickHouse for scheduled queries (dashboards, alerts, sub-second…
Read the breakdown →
Component reference
$60/mo
Apache Spark — security data architecture
The batch-processing engine underneath dbt-on-lakehouse, OCSF normalization at TB/day, and ACID writes to Iceberg. Driver–executor parallelism, Catalyst…
Read the breakdown →
See how the pattern lands on your workload.
The matrix scoring that justified each reference architecture's tool choices is public, and so is the benchmark behind it, so you can reproduce it on your own workload and weight the scores to your own environment.