# Position Next to SIEM and Data Lake ## It makes the existing tools affordable rather than replacing them The company is explicit that TelemetriX is not a SIEM and not a data lake. The comparison it draws: | Capability | SIEM / SOC | Data lake | TelemetriX | | --- | --- | --- | --- | | High-speed ingestion | cost-prohibitive | batch-oriented | carrier-scale throughput | | Real-time alerting | strong | weak | enriches and routes signal | | Long-term retention | expensive | strong | time-series optimised | | Forensic reconstruction | retention-limited | possible but slow | native, hot search window | | Cost model at scale | ingestion-heavy | storage-heavy | aligned to routing economics | | Threat enrichment | add-on | not native | built-in | > [!tip] Why not competing is the point > A product that replaces Splunk has to win a bake-off, survive a procurement cycle and carry the risk of a migration. A product that ==reduces the Splunk bill while leaving Splunk in place== is bought by the same person who owns the Splunk relationship, and nobody has to admit a past decision was wrong. The same logic makes SIEM vendors, DNS platforms and consultancies available as channel partners rather than opponents. Splunk Partnerverse, the Microsoft marketplace and Infoblox are all listed as planned ecosystems. ## Why it matters It defines who has to say yes. Replacement sales need a CISO and a budget cycle. Augmentation sales need a security engineering lead with a cost problem, which is a faster and lower path into the account. The trade-off is that the position is only comfortable while the incumbents ignore it. Tiered pricing and native routing features from a large SIEM vendor would compress the saving, and that is the competitive dynamic to watch over the next few years. ## Related - [[Red Onion MOC]] - [[Separating Capture Economics from Analytics Economics]] - [[The Cost of Keeping Everything]] - [[DNS Security Vendor Landscape]] - [[Splunk]] - [[Google Chronicle and Microsoft Sentinel]] - [[Incumbent Bundling Risk]]