{"resourceId":"crowdstrike-dynatrace-siem-observability-partnership-2026-11-02","versions":[{"version":"external-0db1214e22e4590210e3f439e102801dd605438cd868d9ca3eb69202d7e44596","resource":{"id":"crowdstrike-dynatrace-siem-observability-partnership-2026-11-02","title":"CrowdStrike and Dynatrace join forces to disrupt legacy SIEM and observability","organization":"CrowdStrike and Dynatrace","sector":"Cybersecurity and observability vendors","geography":"Global (announced at Fal.Con Europe, Barcelona)","publishedAt":"2026-11-02","publicationDate":"2026-11-02","eventDate":"2026-11-02","sourceName":"CrowdStrike press release","sourceLabel":"Vendor press release","sourceUrl":"https://www.crowdstrike.com/en-us/press-releases/crowdstrike-dynatrace-join-forces-disrupt-legacy-siem-observability/","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["data-security","infrastructure","operating-model","governance-procurement"],"finding":"CrowdStrike and Dynatrace announce three integrations available today: Falcon federated search across Dynatrace observability and log telemetry without duplicating data, Dynatrace correlation of CrowdStrike endpoint telemetry with application and infrastructure data, and Bindplane by Dynatrace routing of logs between the two. The companies claim lower data costs and less lock-in but give no cost figures, customers or benchmarks. Each says it is deploying the other's technology internally.","sledRelevance":"Relevant to state and local governments and universities facing SIEM log-ingestion costs and retention mandates: federated search could avoid paying twice to store logs. No public-sector customer or cost data is given.","evidence":"Vendor announcement; cost-reduction claims are unquantified.","architectureImplications":"Federated search queries data in place rather than ingesting it; routing via Bindplane lets agencies choose where telemetry lands.","governanceImplications":"Agencies must confirm that federated, in-place data still meets evidence retention and chain-of-custody requirements.","securityPrivacyImplications":"Sharing telemetry across two vendors' platforms widens the set of systems holding sensitive log data.","caveats":"No cost figures, customer results or independent evaluation; the AI framing is positioning.","streamIds":["crowdstrike"],"roles":{"sales":"Log cost is the framing point. Many state and local agencies and universities struggle with SIEM ingestion fees and retention rules, and this partnership claims to let security teams search Dynatrace data without duplicating it. Interpretation: ask customers what they pay to ingest and retain logs today and whether they already run Dynatrace. Do not quote savings; the release gives no figures, customers or public-sector examples, and the cost claim is the vendors' own.","engineering":"Data placement is the framing point. Federated search leaves observability logs in Dynatrace while Falcon queries them, and Bindplane routes telemetry between the platforms. Interpretation: pre-sales should check query latency, retention alignment and access controls across both platforms. Proof of value should compare investigation time and storage volume before and after, using the customer's own data. Constraints include needing both products and confirming that evidence held in place satisfies records and legal hold rules.","delivery":"Integration hygiene is the framing point. Delivery work involves configuring federated search, telemetry routing and shared context, then retiring duplicate log pipelines safely. Interpretation: the customer's SOC manager owns detection outcomes, while the operations team owns Dynatrace. Proposed acceptance criteria include measured reduction in duplicated log volume and no loss of security-relevant data. Risks include dropping logs needed for compliance and adding a second vendor to incident response workflows."},"roleDetails":{"sales":{"customerProblem":"SIEM ingestion and retention costs force agencies to drop or duplicate logs.","stakeholders":["CISO","IT operations director","Budget office"],"discoveryQuestions":["What do you pay annually to ingest and retain logs?","Do you already run Dynatrace?","Which logs do you skip today because of cost?"],"valueHypothesis":"Querying observability logs in place may cut duplicate storage; no figures support a specific saving.","potentialEngagement":"A log-cost and duplication assessment for agencies running both tools.","unsupportedClaims":["Specific cost savings","Faster investigations in public-sector settings","Elimination of legacy SIEM"]},"engineering":{"fit":"Agencies or universities running both CrowdStrike Falcon and Dynatrace.","architectureIntegration":"Falcon federated search over Dynatrace logs; Bindplane routing between platforms.","prerequisites":["Both platforms licensed","Log inventory and retention map"],"constraints":["Requires two vendors","Records and legal hold rules may require central storage"],"security":"Cross-platform access controls and audit trails must be reviewed.","proofOfValue":["Measure duplicated log volume before and after","Time a sample investigation using federated search","Confirm retention compliance for in-place data"]},"delivery":{"work":"Configure integrations and retire duplicate pipelines.","dependencies":["IT operations team","SOC","Records officer"],"ownership":"Customer SOC manager with IT operations.","skillsAdoption":"Analysts learn federated query workflows.","governanceCheckpoints":["Records retention review","Access control approval"],"acceptanceCriteria":["Proposed: measurable drop in duplicated log volume","Proposed: no security-relevant source lost after cutover"],"risks":["Losing compliance logs","Added vendor complexity in incidents"]}},"retrievedAt":"2026-11-02T22:09:18-06:00","enrichedAt":"2026-11-03T15:11:54-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Analysts need training on cross-platform queries.","procurementImplications":"Requires both products; check existing contracts before assuming savings.","operatingModelImplications":"Security and IT operations share telemetry and context, requiring agreed ownership.","sourceVerification":{"openedUrl":"https://www.crowdstrike.com/en-us/press-releases/crowdstrike-dynatrace-join-forces-disrupt-legacy-siem-observability/","referenceExcerpt":"giving security teams application and infrastructure context without duplicating data or increasing ingestion costs.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}