Tenzir

The section your link pointed to isn't on Tenzir's page any more, so we've brought you to the top.

Tenzir is a data pipeline engine for security teams that collects, transforms, enriches, and routes telemetry.

yield hmac('sha256', secret('MY_HMAC_KEY'), data)
to_duckdb "alerts.duckdb"
tenzir-test --root test --report-json artifacts/tests.json
CREATE TABLE events (
  `src.port` UInt32,
  extra JSON COMMENT 'tenzir:catch_all'
) ENGINE = MergeTree ORDER BY tuple();
tenzir-platform secret store add azure \
  --vault-url=https://example.vault.azure.net \
  --managed-identity \
  --workspace=t-example1
tenzir-platform admin create-workspace team my-team --json
TENZIR_PLATFORM_ADMIN_RULES=[{"auth_fn":"auth_user","user_id":"google-oauth2:12345678901"},{"auth_fn":"auth_user","user_id":"google-oauth2:12345678902"}]
BLOB_STORAGE__NODES_PUBLIC_ENDPOINT_URL=https://s3.internal.example.com
PRIVATE_JWT_FROM_HEADER=X-Goog-IAP-JWT-Assertion
TENZIR_PLATFORM_UI_ENDPOINT=https://app.platform.example
TENZIR_PLATFORM_NODES_ENDPOINT=wss://nodes.platform.example
TENZIR_PLATFORM_DOWNLOADS_ENDPOINT=https://downloads.platform.example
TENZIR_PLATFORM_API_ENDPOINT=https://api.platform.example
services:
  websocket-gateway:
    environment:
      - TLS_CERTFILE=/ssl/gateway-cert.pem
      - TLS_KEYFILE=/ssl/gateway-cert.pem
      - TLS_CAFILE=/ssl/ca.pem
    volumes:
      - ./ssl/gateway-cert.pem:/ssl/gateway-cert.pem
      - ./ssl/ca.pem:/ssl/ca.pem
IMAGE_TAG=latest
AWS_REGION=$(aws configure get region)
AWS_ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
aws cloudformation create-stack \
  --stack-name tenzir-platform \
  --template-url https://tenzir-marketplace-resources.s3.eu-west-1.amazonaws.com/tenzir-platform.yml \
  --parameters \
    ParameterKey=DomainName,ParameterValue=example.org \
    ParameterKey=RandomSubdomain,ParameterValue=false \
    ParameterKey=UseExternalOIDC,ParameterValue=false \
    ParameterKey=ContainerImageUI,ParameterValue=$AWS_ACCOUNT.dkr.ecr.$AWS_REGION.amazonaws.com/tenzir/se-platform-ui:$IMAGE_TAG \
    ParameterKey=ContainerImageAPI,ParameterValue=$AWS_ACCOUNT.dkr.ecr.$AWS_REGION.amazonaws.com/tenzir/se-platform-api:$IMAGE_TAG \
    ParameterKey=ContainerImageGateway,ParameterValue=$AWS_ACCOUNT.dkr.ecr.$AWS_REGION.amazonaws.com/tenzir/se-platform-gateway:$IMAGE_TAG \
  --capabilities CAPABILITY_NAMED_IAM
VERSION=v1.0.0 ./copy-images.sh
aws cloudformation create-stack \
  --stack-name tenzir-platform \
  --template-url https://tenzir-marketplace-resources.s3.eu-west-1.amazonaws.com/tenzir-platform.yml \
  --parameters \
    ParameterKey=DomainName,ParameterValue=example.org \
    ParameterKey=UseExternalOIDC,ParameterValue=true \
    ParameterKey=ExternalOIDCIssuerURL,ParameterValue=https://idp.example.org \
    ParameterKey=ExternalOIDCClientID,ParameterValue=<client-id> \
    ParameterKey=ExternalOIDCClientSecret,ParameterValue=<client-secret> \
    ParameterKey=ContainerImageUI,ParameterValue=<ui-image-uri> \
    ParameterKey=ContainerImageAPI,ParameterValue=<api-image-uri> \
    ParameterKey=ContainerImageGateway,ParameterValue=<gateway-image-uri> \
  --capabilities CAPABILITY_NAMED_IAM
tenzir:
  index:
    default-fp-rate: 0.01
    rules:
      - targets:
          - suricata.http.http.url
        fp-rate: 0.005
      - targets:
          - :ip
        fp-rate: 0.10
tenzir:
  start:
    commands:
      - web server \
          --certfile=/path/to/server.certificate \
          --keyfile=/path/to/private.key \
          --mode=server
tenzir-node --commands="web server --mode=dev"
tenzir:
  tls:
    tls-min-version: "1.2"
    tls-ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
    cacert: "/etc/ssl/certs/ca-certificates.crt"
tenzir:
  tls:
    certfile: "/etc/tenzir/server.crt"
    keyfile: "/etc/tenzir/server.key"
    tls-client-ca: "/etc/tenzir/client-ca.crt"
    require-client-cert: true
plugins:
  platform:
    cacert: "/etc/ssl/certs/ca-certificates.crt"
    certfile: "/etc/tenzir/platform-client.crt"
    keyfile: "/etc/tenzir/platform-client.key"
    tls-min-version: "1.2"
    tls-ciphers: "HIGH:!aNULL:!MD5"
tenzir:
  http-proxy: http://proxy.example.com:3128
  https-proxy: http://proxy.example.com:3128
  no-proxy: .internal,10.0.0.0/8
tenzir:
  pipeline-subprocesses: true
tenzir:
  endpoint: false
tenzir -f pipeline.tql
tenzir:
  pipelines:
    suricata-over-tcp:
      name: Onboard Suricata from TCP
      description: |
        Onboards Suricata EVE JSON from TCP port 34343.
      definition: |
        accept_tcp "0.0.0.0:34343" {
          read_suricata
        }
        publish "suricata"
      restart-on-error: 1 minute
      labels:
        - Suricata
        - Onboarding
      disabled: false
      unstoppable: true
cat input.yaml | tenzir 'read_yaml | select x | write_csv'
tenzir:
  tls:
    min-version: "1.2"
    ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384"
tenzir:
  http-proxy: http://proxy.example.com:3128
  https-proxy: http://user:password@proxy.example.com:3128
  no-proxy: .internal,10.0.0.0/8
tls-min-version: "1.3"
tls-ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
export
where @name == "zeek.conn"
where service != null
top service
head
chart_pie label=service value=count
metrics "publish"
chart_line (
  x=timestamp
  y=sum(events)
  x_min=now() - 1d
  group=pipeline_id
  resolution=30min
)
from (
  {outcome: "tails", n: 30, time: "Morning"}
  {outcome: "heads", n: 20, time: "Morning"}
  {outcome: "tails", n: 25, time: "Afternoon"}
  {outcome: "heads", n: 35, time: "Afternoon"}
)
chart_bar x=outcome y=n group=time position="stacked"
npx skills add -g tenzir/skills@tenzir-ocsf
npx skills add tenzir/skills@tenzir -a claude-code -a cursor
npx skills update
npx skills list -g
npx skills check
npx skills update
from_microsoft_365_activity
  auth = {
    tenant_id: secret("m365-tenant-id")
    client_id: secret("m365-client-id")
    client_secret: secret("m365-client-secret")
  }
  content_types = ["Audit.General"]
subscribe "ocsf"
| sigma path="sigma/rules" mapping="direct"
from_microsoft_defender "DeviceEvents | take 10"
  azure_auth = {
    tenant_id: secret("AZURE_TENANT_ID")
    client_id: secret("AZURE_CLIENT_ID")
    client_secret: secret("AZURE_CLIENT_SECRET")
  }
from_azure_log_analytics "SecurityEvent | project TimeGenerated, Computer, EventID"
  workspace_id = secret("azure-workspace-id")
  azure_auth = {
    tenant_id: secret("azure-tenant-id")
    client_id: secret("azure-client-id")
    client_secret: secret("azure-client-secret")
  }
  start = 2026-01-01
  end   = 2026-01-02
to_splunk "https://splunk.example.org:8088"
  hec_token = secret("hec")
  parallel  = 8
from_microsoft_365_activity
  auth = {
    tenant_id: secret("m365-tenant-id")
    client_id: secret("m365-client-id")
    client_secret: secret("m365-client-secret")
  }
  content_types = ["Audit.General"]
from_azure_blob_storage "abfss://logs@customer1.dfs.core.windows.net/**.json.gz"
  azure_auth = {
    tenant_id: secret("customer1-entra-tenant")
    client_id: secret("customer1-entra-client")
    web_identity: {
      token_endpoint: {
        url: env("ACTIONS_ID_TOKEN_REQUEST_URL")
        query_params: { "audience": "api://AzureADTokenExchange" }
        headers: { "Authorization": "Bearer " + env("ACTIONS_ID_TOKEN_REQUEST_TOKEN") }
        path: ".value"
      }
    }
  }
{ read_json }
from_microsoft_365_activity
  auth = {
    tenant_id: secret("m365-tenant-id")
    client_id: secret("m365-client-id")
    client_secret: secret("m365-client-secret")
  }
  content_types = ["Audit.General"]
subscribe "ocsf"
| sigma path = "sigma/rules" mapping="direct"
from_azure_blob_storage "abfss://logs@customer1.dfs.core.windows.net/**.json.gz"
  azure_auth = {
    tenant_id: secret("customer1-entra-tenant")
    client_id: secret("customer1-entra-client")
    web_identity: {
      token_endpoint: {
        url: env("ACTIONS_ID_TOKEN_REQUEST_URL")
        query_params: { "audience": "api://AzureADTokenExchange" }
        headers: { "Authorization": "Bearer " + env("ACTIONS_ID_TOKEN_REQUEST_TOKEN") }
        path: ".value"
      }
    }
  }
| read_json
from_file "windows-events.xml" { read_delimited "</Event>\n", include_separator = true }
microsoft::windows::ocsf::normalize
sigma path = "sigma/rules/windows/process_creation/proc_creation_win_powershell_script_engine_parent.yml"
demo::windows "xml", speed = 10.0
microsoft::windows::ocsf::normalize raw
sigma path = "sigma/rules/windows/process_creation/proc_creation_win_powershell_non_interactive_execution.yml"
accept_splunk hec_token = secret("splunk-hec-token"), ack = true
parallel 8, fuse = "none", limit_partitions = 2 {
  where y > 100
  summarize g, total = sum(x)
}
read_avro < data.avro | ...
require_author: true
omit_pr: true
tenzir-ship validate --all-entries
require_author: true
tenzir-ship validate --all-entries
pre-compare: sort
accept_otlp "0.0.0.0:4318", transport="http"
tenzir:
  parallelism: max,limit_partitions=8
tail "$TENZIR_NODE_STDERR_LOG"
write_pcap format = "pcapng"
accept_relp "0.0.0.0:2514"
syslog = data.parse_syslog()
global(workDirectory="/var/spool/rsyslog")
module(load="omrelp")
action(
  type="omrelp"
  target="tenzir.example.com"
  port="2514"
  action.resumeRetryCount="-1"
  queue.type="LinkedList"
  queue.filename="tenzir-relp"
  queue.saveOnShutdown="on"
)
accept_relp "0.0.0.0:2514"
this = data.parse_syslog()
openssh::parse
openssh::ocsf::map
fork {
  where status_id == 2
  to_splunk "https://splunk.example.com:8088", hec_token = secret("splunk-hec-token")
}
to_iceberg "security.ocsf", catalog = "https://catalog.example.com", partition_by = [class_uid, day(time)]
window size=5min, trailing=true, on=ts {
  summarize rolling_bytes = sum(bytes)
  this = { ...$window.event, rolling_bytes: rolling_bytes }
}
summarize dst, times=collect(t), samples=count()
beat = times.dominant_period(resolution=5s)
where samples >= 8 and beat.strength >= 0.8
select dst, period=beat.period, strength=round(beat.strength * 100) / 100
from_file "capture.nfv9" { read_auto }
from connections | summarize times=collect(ts) by src_ip, dest_ip | extend d=deltas(times) | extend period=dominant_period(autocorrelation(d))
from connections | summarize times=collect(ts) by src_ip | extend d=deltas(times) | where mad(d) > 5s or skewness(d) > 2.0
from connections | summarize times=collect(ts) by src_ip, dest_ip | extend d=deltas(times) | extend period=dominant_period(autocorrelation(d))
from connections | summarize times=collect(ts) by src_ip | extend d=deltas(times) | where mad(d) > 5s or skewness(d) > 2.0
from_file "capture.nfv9" { read_auto }
subscribe "ocsf"
ocsf::cast
to_iceberg "security.ocsf", catalog = "https://catalog.example.com", partition_by = [class_uid, day(time)]
accept_udp "0.0.0.0:2055", binary = true
read_netflow
tenzir.index.load-concurrency: 16
tenzir.index.lazy-sketches: true
tenzir.index.sketch-cache-bytes: 2147483648
tenzir.index.skip-synopsis-verification: true
subscribe "ocsf"
ocsf::cast
to_iceberg "security.ocsf", catalog = "https://catalog.example.com", partition_by = [class_uid, day(time)]
accept_udp "0.0.0.0:2055", binary = true
read_netflow
tenzir.index.lazy-sketches: true
tenzir.index.skip-synopsis-verification: true
tenzir.index.sketch-cache-bytes: 2147483648  # 2 GiB
tenzir.index.load-concurrency: 16
tenzir-ship release create --major --yes
tenzir-ship release create --major --yes
subscribe "ocsf"
ocsf::cast
to_iceberg "security.ocsf", catalog = "https://catalog.example.com", partition_by = [class_uid, day(time)]
from { x: "2026-07-21 13:55:59.000 GMT" }
x = x.time()
from { x: "not a timestamp" }
x = x.time()
from { x: "2026-07-21 13:55:59.000 GMT" }
x = x.time()
from { x: "not a timestamp" }
x = x.time()
where ts > 2026-07-21T13:55:59.123+02:00
tenzir-platform admin create-user-key <workspace_id> <user_id>
require_pr: true
omit_pr: true
omit_author: true
tenzir-ship validate
tenzir-ship validate --lenient
brand: data/brand.yml
npx skills add tenzir/skills@tenzir-create-package
npm run check
npm run fix
accept_opensearch "0.0.0.0:9200" publish "events"
match action { "accept" | "allow" => { verdict = "allowed" } "deny" | "drop" => { verdict = "blocked" } _ => { verdict = "unknown" } }
brew install --cask tenzir/tenzir/tenzir
tenzir-test --run-skipped-reason 'maintenance'
tenzir-test --run-skipped-reason '*docker*'
uvx tenzir-test --fixture mysql
uvx tenzir-test --fixture 'kafka: {port: 9092}' --debug
from_http "https://api.example.com/data", paginate="link"
args:
  positional:
    - name: api_key
      type: secret
      description: "API key to use for authentication"
tenzir-test -m '*context*' -m '*create*'
uvx tenzir-test --package-dirs example-library example-library
load_file "data.txt"
read_delimited "||"
where this.has("foo") and foo == 42
tenzir-node --tql2
metrics cpu
every 1h from http://foo.com/bar
openapi | to ./openapi.yaml
context inspect <context-name>
vast export json '#import_time > 1 hour ago'