Telemetry is not observability
Telemetry is what your systems say about themselves: logs, metrics, traces, and events. It is the only record you have of what has happened, what is happening now, and what is about to happen. Most operational questions are answered out of that record, or they are not answered at all.
Observability is what you do with the record once it reaches somewhere it can be queried - turning it into answers about service health, application behavior, and the business running on top. Security work asks different questions of the same record, in different tools, leaning on logs and events rather than metrics and traces.
Two consumers, one foundation.
The pipeline is the architecture
Most organizations buy an analytics platform and inherit a pipeline along with it. Collection, processing, and routing arrive as features of that product, built to feed that product. It works - until something has to change, and the pipeline turns out not to be yours to change.
We build it the other way around: a pipeline layer of its own, sitting between the systems that produce telemetry and the systems that consume it. The layer runs on a dedicated telemetry pipeline platform, Cribl Stream for example. Everything downstream is a destination - an observability platform, a SIEM, an analytics store, an archive - and destinations are meant to be interchangeable.
That cuts both ways, which is the part usually missed. Replacing a platform becomes a routing change rather than a re-instrumentation project. And when the systems producing telemetry are themselves replaced or re-instrumented, the change is absorbed in the pipeline instead of propagating to everything downstream. Both ends of the estate become movable.
It is also how we collect what is actually there. Application instrumentation is converging on OpenTelemetry and we build with it, but an estate is not only applications: network equipment, appliances, databases, and infrastructure that predates the standard emit syslog and cannot be made to do otherwise. In many environments those sources are the bulk of what exists.
How that gets built
The work divides three ways. Pipeline architecture establishes the layer, shaping data before it lands makes what flows through it worth what it costs, and retention as a design choice changes what you can afford to keep.
Where we work
We build and run the foundation. Today most of it feeds teams working in a SIEM; the same foundation serves observability, and that is where we are taking this area next. Security use cases are delivered together with our Cybersecurity area - the pipeline underneath is the same either way, which is rather the point.