Elastic argues SIEM vendors should provide free, complete, real-time telemetry access
Summary
Elastic argues that extra fees, partial exports, and batch delays for SIEM telemetry can create vendor lock-in and hinder incident response. It urges buyers to assess export cost, data completeness, and latency.
Key points
- Elastic defines open telemetry access as customer-owned data available at no extra cost, in full fidelity, and in real time.
- The article warns that paid exports, partial data, and batch delivery can create vendor lock-in and delay incident investigations.
- It cites CrowdStrike's 2026 Global Threat Report, including a 29-minute average eCrime breakout time, a 27-second fastest time, and one intrusion where exfiltration began four minutes after initial access.
- Elastic says buyers should assess export costs, telemetry completeness, and the time from an event to usable data.
- The article argues that portable telemetry helps teams bring endpoint, cloud, and identity data together across heterogeneous environments.
Article Details
- Topic
- Security telemetry access, portability, and vendor lock-in
Vendors
CrowdStrikedelivery, or only provide partial data create lock-in and weaken incident response, with references to CrowdStrike’s 2026 Global Threat Report and Elastic’s own stance on live access.Elasticlock-in and weaken incident response, with references to CrowdStrike’s 2026 Global Threat Report and Elastic’s own stance on live access.MicrosoftPartially open means the vendor genuinely tries but with real constraints; credit to Microsoft for a true streaming path, even if it covers only generally-available fields and only lands in Azure.