Query in place: why the pipeline should also be the search layer

The retention bargain

Every team makes the same trade. Keep more data in the analytics platform and pay for it. Keep less and lose the ability to look back. The compromise is usually a tiered layout: a few months of high-value sources in the SIEM, a longer tail in object storage, and several systems that hold their own history and are never exported at all.

The result is that a single investigation touches four consoles, four query languages, and a spreadsheet to line the answers up.

What changes when the pipeline can search

The pipeline routed every event, so it knows where every event went. CyberAIX Federated Search uses that knowledge to run one question across all of those places at once, in place, without copying anything into a central store first.

An analyst types: which internal hosts contacted this address in the last three days, and who was signed in on each at the time? The query fans out to the detection platform for network events, to the endpoint tool for process context, to the identity provider for sessions, and to cold storage for a longer baseline. The results come back already joined on host and time window.

Three consequences

Retention gets cheaper. Bulk telemetry can live in low-cost storage without becoming unreachable, because reachability no longer requires ingestion.

Tool comparisons get fair. When two analytics platforms receive the same feed and are queried from one place, the comparison is about detection quality rather than console familiarity.

AI gets a safe door. An investigation agent needs to read from many systems. Giving it one governed interface with query-level guardrails, through CyberAIX Gateway, is far safer than handing it credentials to each store.

What this is not

It is not a replacement for a detection platform. Real-time correlation, alert management, and case handling still need a purpose-built system. Federated search makes that system one source among several instead of the only place an analyst can look.

The prerequisite

Searching across stores only works if the same field has the same name in every store. That is why CyberAIX Federated Search sits on top of CyberAIX Pipeline: the pipeline creates the shared shape, and search takes advantage of it.