Security Data Works

Component references

One engine, isolated.

A component reference takes a single engine or store and answers the architect’s real questions: what it does, where it sits in the pipeline, what it composes with, and what breaks at scale. The surrounding pipeline is generic scaffolding — the accented step is the component the pattern is organized around. Not a full architecture; a building block.

Component reference

Dremio — semantic layer + Reflections

Engine-anchored architecture for organizations with mixed BI and security analytics on shared Iceberg data. Reflections pre-materialize the hot paths; the…

Read the breakdown →

Component reference

3.6×

Trino — federation breadth

Engine-anchored architecture for multi-region, multi-platform SOCs that cannot, or should not, centralize all data into one store. Federate first, then query…

Read the breakdown →

Component reference

<100ms

RisingWave — streaming threat detection

Engine-anchored architecture for SOCs that cannot afford batch latency. PostgreSQL-compatible streaming database; continuous SQL computation over Kafka and CDC…

Read the breakdown →

Component reference

40%

Cribl Search — query in place, never rehydrate

Engine-anchored architecture that queries telemetry directly in cheap object storage. Cribl Stream writes Parquet partitioned by date and source; Cribl Search…

Read the breakdown →

Component reference

$3.04K/mo

StarRocks + ClickHouse — engine specialization

Two engines reading the same Iceberg data, each pinned to the workload it measurably wins on. ClickHouse for scheduled queries (dashboards, alerts, sub-second…

Read the breakdown →

Component reference

$60/mo

Apache Spark — security data architecture

The batch-processing engine underneath dbt-on-lakehouse, OCSF normalization at TB/day, and ACID writes to Iceberg. Driver–executor parallelism, Catalyst…

Read the breakdown →

See how the pattern lands on your workload.

The matrix scoring that justified each reference architecture's tool choices is the paid deliverable. The benchmark behind it is public — reproduce it on your own workload, then book a call to scope the work.