From the CrowdStrike edition of November 2, 2026
CrowdStrike and Dynatrace join forces to disrupt legacy SIEM and observability
CrowdStrike and Dynatrace · Cybersecurity and observability vendors · Global (announced at Fal.Con Europe, Barcelona)
- Publisher
- CrowdStrike press release
- Original publication
- 2026-11-02
- Source retrieved
- 2026-11-03
- Event date
- 2026-11-02
What happened
CrowdStrike and Dynatrace announce three integrations available today: Falcon federated search across Dynatrace observability and log telemetry without duplicating data, Dynatrace correlation of CrowdStrike endpoint telemetry with application and infrastructure data, and Bindplane by Dynatrace routing of logs between the two. The companies claim lower data costs and less lock-in but give no cost figures, customers or benchmarks. Each says it is deploying the other's technology internally.
Why it matters
Relevant to state and local governments and universities facing SIEM log-ingestion costs and retention mandates: federated search could avoid paying twice to store logs. No public-sector customer or cost data is given.
Evidence and measured results
Vendor announcement; cost-reduction claims are unquantified.
Limitations and uncertainty
No cost figures, customer results or independent evaluation; the AI framing is positioning.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-03; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- SIEM ingestion and retention costs force agencies to drop or duplicate logs.
- Stakeholders
- CISO
- IT operations director
- Budget office
- Discovery questions
- What do you pay annually to ingest and retain logs?
- Do you already run Dynatrace?
- Which logs do you skip today because of cost?
- Value hypothesis
- Querying observability logs in place may cut duplicate storage; no figures support a specific saving.
- Potential engagement
- A log-cost and duplication assessment for agencies running both tools.
- Unsupported claims
- Specific cost savings
- Faster investigations in public-sector settings
- Elimination of legacy SIEM
Pre-sales engineering
Role takeaway
- Fit
- Agencies or universities running both CrowdStrike Falcon and Dynatrace.
- Architecture and integration
- Falcon federated search over Dynatrace logs; Bindplane routing between platforms.
- Prerequisites
- Both platforms licensed
- Log inventory and retention map
- Constraints
- Requires two vendors
- Records and legal hold rules may require central storage
- Security
- Cross-platform access controls and audit trails must be reviewed.
- Proof of value
- Measure duplicated log volume before and after
- Time a sample investigation using federated search
- Confirm retention compliance for in-place data
Delivery
Role takeaway
- Work
- Configure integrations and retire duplicate pipelines.
- Dependencies
- IT operations team
- SOC
- Records officer
- Ownership
- Customer SOC manager with IT operations.
- Skills and adoption
- Analysts learn federated query workflows.
- Governance checkpoints
- Records retention review
- Access control approval
- Acceptance criteria
- Proposed: measurable drop in duplicated log volume
- Proposed: no security-relevant source lost after cutover
- Risks
- Losing compliance logs
- Added vendor complexity in incidents
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Federated search queries data in place rather than ingesting it; routing via Bindplane lets agencies choose where telemetry lands.
Governance
Who approves, reviews and stays accountable for outcomes?
Agencies must confirm that federated, in-place data still meets evidence retention and chain-of-custody requirements.
Security and privacy
What data, permissions and controls need testing?
Sharing telemetry across two vendors' platforms widens the set of systems holding sensitive log data.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Analysts need training on cross-platform queries.
Procurement
What should contracts, pricing and exit terms secure?
Requires both products; check existing contracts before assuming savings.
Operating model
Which teams own the service once it runs?
Security and IT operations share telemetry and context, requiring agreed ownership.
Publication history
- 2026-11-02CrowdStrike · Issue 054 resources
Stable resource ID: crowdstrike-dynatrace-siem-observability-partnership-2026-11-02