# What TelemetriX Does ## Four steps between the data source and the tools that consume it ```mermaid graph LR SRC[Sources: DNS, firewall,<br/>auth, app and infra] --> CAP[Capture<br/>100%, no source impact] CAP --> ENR[Enrich<br/>threat intel, identity, policy] ENR --> RTE[Route<br/>policy decides destination] RTE --> RET[Retain<br/>hot search + long archive] RTE --> OUT[SIEM, data lake,<br/>compliance, fraud, AI] RET --> OUT class SRC,CAP,ENR,RTE,RET,OUT internal-link; ``` **Capture.** Collector nodes sit near DNS clusters, firewalls and authentication infrastructure. Designed for millions of events per second with no impact on the source. **Enrich.** Events are correlated in real time with threat intelligence, asset databases, geo-IP, identity context and policy tags. Target processing time is under 10ms. **Route.** A policy engine decides where each enriched event goes: SIEM, archive, fraud system, AI pipeline or billing. **Retain.** Time-series storage keeps the full trail searchable and audit-ready. **Consume.** Output is vendor-neutral: Syslog, API, Kafka, S3, Sentinel, Splunk, Elastic and others. > [!important] No rip-and-replace > It deploys alongside Infoblox, BIND, Splunk, Elastic, QRadar, Microsoft Sentinel, Azure, AWS and custom data lakes. Nothing the customer already owns has to be removed, which is what makes a pilot possible without a procurement cycle. ## Why it matters Everything the company claims later rests on these four steps being one product rather than four. Capture without enrichment gives noise. Enrichment without routing gives a better SIEM bill and nothing else. Retention without capture gives an incomplete archive. Sold together they become a control point. ## Related - [[Red Onion MOC]] - [[Separating Capture Economics from Analytics Economics]] - [[DNSTAP and Where the Data Comes From]] - [[Why It Becomes Hard to Remove]] - [[One Pattern, Many Data Sources]]