Trevane | In-VPC Telemetry Pipeline & Compliance Lakehouse

Ingestion Volume

0.0 MB

Waiting for stream or file input

Volume Reduction

0.0% Reduction

10s deduplication window

Cold Storage (S3 Parquet)

0.0 MB

100% of raw events archived (Zstd Parquet)

Rule Evaluation Latency

< 0.05 ms

In-memory pattern evaluation

Telemetry Audit & Benchmark

Select a reference dataset or upload a capture file to replay authentic telemetry through the in-VPC pipeline at manageable speed.

Upload Log File (.json.gz, .json, .log, .jsonl)

Drag and drop file here, or browse files

Reference Datasets (Click to Replay):

Replaying Stream: Splunk BOTSv3 Enterprise Suite • Manageable Rate (~1,200 EPS)

0 EPS

Ingress Feeds 3 Connected

Host & Endpoint (Sysmon / EDR)

Connected

Process & host telemetry • 0 EPS

0 KB/s

AWS CloudTrail

Active

Management & API audit stream • 0 EPS

0 KB/s

VPC Flow Logs

Attached

Network interface connection flows • 0 EPS

0 KB/s

In-VPC Data Plane (Zero Egress) Private Subnet 10.0.4.0/24

Deduplication & Templating

10s Window

Volume Reduction

0.0%

Active Templates

0 Active Templates

Extracts structural templates from high-entropy logs while archiving 100% of raw events to S3 Parquet.

Rate Limiting & Safety Invariants

< 18 ns / token

Pinned Keys

4 Keys (IP, User, Status, Error)

Pass-First-N Gate

3 (Info) · 25 (Warn) · 100 (Error)

Template Extraction SLA

< 18 ns (Rust ahash)

SIEM Forwarding

Rollup Summaries

Pins critical security fields (IP, user ID, status code, error) to prevent collapsing across distinct entities or masking alert spikes.

Destination Sinks Segregated

Tier 1: S3 Compliance Lakehouse

100% Raw Storage

Zstd-compressed Parquet in customer S3 (WORM Object Lock). Retained for compliance and SQL querying.

Tier 2: Operational SIEM (Datadog / Splunk)

~25% Forwarded Volume

Forwards first-seen alerts, high-severity events, and statistical rollups. Cuts daily ingestion volume by ~50%.

Telemetry Volume & Ingestion Ledger

Throughput, reduction rate, and destination tier routing by feed

Open FinOps Audit

Telemetry Feed	Volume Reduction	Cold Storage Status
Host & Endpoint (Sysmon / EDR)	0.0%	100% Retained (Zstd Parquet)
AWS CloudTrail	0.0%	100% Retained (Zstd Parquet)
VPC Flow Logs & Network	0.0%	100% Retained (Zstd Parquet)

Feed Source:

5 Raw Ingress Records (1.8 KB) → 10s Window Deduplication → 1 Forwarded Record (-82.5%)

Cold Storage: 100% of raw events in S3 Parquet · Zero data loss

Raw Ingress Payloads (Incoming) 5 Folded Events

Dynamic fields highlighted

Raw events in window:

Event 1 of 5

Forwarded Record (to SIEM) Folded: 5 Events

Hash: a4f89c02b18e77a1

Bypass Filters & Invariant Safeguards

Guarantees that security-critical events (reverse shells, audit tampering, credential dumping) bypass deduplication and forward to the SIEM in < 0.05 ms.

Active Invariants: 4 Active Filters Evaluation SLA: < 0.05 ms (Rust SIMD) Attack Event Loss: 0.0% (Lossless)

How Invariant Bypass Works

While Trevane folds 70–80% of routine machine noise (health checks, WMI polls, cron jobs), any event matching a security invariant never enters a rollup window. It is evaluated in-flight inside the VPC via Rust SIMD matching (< 0.05 ms) and forwarded verbatim to your SIEM, while 100% of raw bytes are retained in your S3 Parquet compliance vault.

Active Passthrough Invariants

Baseline enterprise security patterns guaranteed to bypass deduplication.

Enforced in-VPC

Filter ID	Target Sensor / Feed	Threat Signature & Match Condition	Pipeline Action	Match SLA	Status
INV-HOST-001	CrowdStrike / Sysmon	Host Reverse Shell & Interactive Process curl.\\|.(bash\|sh) \| sh -i \| bash -i \| nc -e	Immediate SIEM Passthrough · Never Folded	< 0.04 ms	Active
INV-CLOUD-002	AWS CloudTrail	CloudTrail Audit Tampering (T1562.008) eventName IN (StopLogging, DeleteTrail, UpdateTrail)	Immediate SIEM Passthrough · Never Folded	< 0.03 ms	Active
INV-HOST-003	Sysmon / Endpoint	Shadow Copy Tampering & Credential Dump (T1003) vssadmin delete shadows \| powershell SAM/LSASS memory access	Immediate SIEM Passthrough · Never Folded	< 0.04 ms	Active
INV-IAM-004	AWS CloudTrail IAM	Stealth Backdoors & Privilege Escalation (T1078/T1098) CreateAccessKey bursts \| AssumeRole Admin escalation	Immediate SIEM Passthrough · Never Folded	< 0.05 ms	Active

Live Passthrough Verification

Inject an authentic security event to verify in real time that deduplication is bypassed.

Security Passthrough Log

Recent security-significant events that bypassed deduplication and were forwarded to SIEM.

Timestamp	Severity	Filter Triggered	Target IP	Finding / Command Payload	Pipeline Action

Lakehouse SQL Console (DuckDB)

Query local cache and S3 Parquet partitions directly with zero ingest or scan fees

Query Templates:

Ready

Shortcut: Ctrl + Enter to execute

Status	Message
Execute a query or select a template above to query Parquet storage.