At a glance
| Feature | Derwent Labs | Tenzir |
|---|---|---|
| Normalisation approach | OCSF-native — all 200+ connectors output OCSF 1.7 automatically | OCSF via TQL pipeline code — mappings defined as queries or generated with AI |
| Output schema | OCSF 1.7 (all sources) | OCSF, ASIM, ECS, CIM, UDM, or custom — schema is configurable |
| Open source | No — fully managed closed-source SaaS | Yes — node engine is open source on GitHub; platform is open core |
| Connector / format count | 200+ security sources | 100+ vendor format packages (built-in + community library) |
| SIEM migration | Dual-write to old and new SIEM in parallel — built-in | Multi-destination routing via TQL pipeline |
| Primary use case | Managed OCSF normalisation, SIEM migration, detection portability | Open-core security pipeline — self-hosted, query-language-driven |
| Deployment model | Fully managed SaaS (Derwent Labs hosts everything) | You host nodes; platform available as SaaS or self-hosted (Sovereign) |
| Pricing | Contact for pricing | Community Edition free; Professional / Enterprise / Sovereign — contact |
What each product does
Tenzir is an open-core security data pipeline engine built around TQL (Tenzir Query Language). Security teams use it to collect, parse, normalise, enrich, and route telemetry at scale. The pipeline engine (tenzir/tenzir on GitHub) is open source. A management platform sits on top with Community, Professional, Enterprise, and Sovereign (on-premise) tiers.
Tenzir never hosts compute for you: nodes always run in your environment, whether that is your cloud, on-premise servers, or an air-gapped network. OCSF normalisation is handled by writing TQL pipelines — either by hand, drawn from the community library, or generated by an LLM via Tenzir’s MCP server integration.
Derwent Labs is a managed SaaS security data pipeline built around OCSF. It connects to 200+ security sources — EDR, cloud, identity, network, and SIEM platforms — and normalises every event to OCSF 1.7 automatically, without mapping code. The platform is fully managed: Derwent Labs handles infrastructure, scaling, and connector maintenance.
Because OCSF normalisation is built into every connector, detection rules written against Derwent Labs data are portable across SIEMs by default. Dual-write routing supports SIEM migrations by sending the same OCSF stream to an old and a new destination simultaneously.
Where Tenzir and Derwent Labs overlap
Both tools are built for security teams who need to normalise and route telemetry before it reaches a SIEM or data lake. Both support OCSF as an output schema, both can reduce SIEM ingestion volume by filtering and aggregating data upstream, and both can route events to multiple destinations simultaneously. Both also integrate with Amazon Security Lake via OCSF and Apache Parquet.
For teams primarily concerned with reducing SIEM costs, either tool can achieve similar ingestion savings. The divergence is in how normalisation is implemented, who manages the infrastructure, and what happens downstream with the normalised data.
Where they diverge
Managed SaaS vs self-hosted engine
Derwent Labs is fully managed — you connect a source and normalised OCSF data flows to your destination. Tenzir never hosts compute for you: nodes always run in your environment (on-premise, your cloud, or air-gapped). This gives Tenzir users full infrastructure control, but means provisioning, scaling, and maintenance sit with your team.
Automatic normalisation vs pipeline-as-code
In Derwent Labs, every connector outputs OCSF automatically — there is no mapping code to write. Tenzir defines normalisation as TQL pipeline queries, which can be written by hand, sourced from the community library, or generated by an LLM. Pipeline-as-code suits teams who want fine-grained control or need to inspect exactly how each field is mapped.
Single schema vs multi-schema output
Derwent Labs normalises exclusively to OCSF 1.7, which is the right choice when downstream tools expect a single consistent schema. Tenzir can output to OCSF, ASIM, ECS, CIM, or UDM — useful if different destinations in your stack expect different schemas, or if you are still in the process of standardising on one.
When to choose each tool
FAQ
- Is Derwent Labs a Tenzir alternative?
- Yes, for teams that want managed OCSF normalisation without running their own pipeline infrastructure. Derwent Labs is fully managed SaaS with 200+ pre-built connectors outputting OCSF automatically. Tenzir is a better fit when self-hosted deployment, open-source transparency, or pipeline-as-code control are requirements.
- What's the difference between Tenzir and Derwent Labs?
- The core difference is operational model. Tenzir is an open-core pipeline engine: nodes run in your environment and normalisation pipelines are defined in TQL, Tenzir’s query language. Derwent Labs is managed SaaS: connectors output OCSF 1.7 automatically, with no node hosting or mapping code on your side.
- Is Tenzir open source?
- Yes, in part. Tenzir’s node engine is open source on GitHub (the tenzir/tenzir repository). The management platform is open core, with a free Community Edition and paid Professional, Enterprise, and Sovereign (on-premise) tiers. This means you can inspect and contribute to the core pipeline engine, while advanced platform features require a commercial licence.
- Can I migrate from Tenzir to Derwent Labs?
- Yes. Derwent Labs can run in parallel with an existing Tenzir deployment during migration. Because Derwent Labs outputs OCSF natively, the schema your downstream tools see will remain consistent. Contact us to discuss a migration path from your current Tenzir setup.
- Does Derwent Labs support OCSF the same way Tenzir does?
- Both platforms normalise to OCSF, but the mechanism differs. Tenzir uses TQL pipelines with an ocsf::derive operator — the mapping logic is written as code (by you, from the community library, or generated by an LLM). Derwent Labs builds OCSF normalisation into every connector: the output is always OCSF 1.7 with no mapping configuration required.
- Does Tenzir support air-gapped or on-premise deployment?
- Yes. Tenzir’s Sovereign Edition allows the entire platform to be deployed in a Dockerised environment with no external dependencies. This makes Tenzir a strong fit for environments with strict data residency or network isolation requirements. Derwent Labs is SaaS-only and does not currently offer on-premise deployment.