Monad + Hydrolix: Stop Deleting the Data You'll Need During Your Next Investigation

Every security team running a SIEM has made the same quiet trade, whether they've said it out loud or not: keep the data you can afford, and hope the data you deleted or archived isn't the data you will need later.

CDN logs, API telemetry, edge events. The stuff that doesn't trigger a detection on its own but tells you exactly what happened once you're three hours into an incident and need to reconstruct attacker behavior. Most SIEMs charge by the gigabyte ingested, so that telemetry gets sampled, aggregated, or shipped to cold storage after 30 days. Cold storage means hours of rehydration before an analyst can even start querying it. By the time it's back, the investigation has usually moved on without it.

That's the gap Monad and Hydrolix are closing together, for security teams running their own SIEM and for MSSPs facing the same math multiplied across every customer environment they manage.

Why the Usual Fixes Don't Fix It

Sampling loses the record you needed. Aggregation loses the field you needed. Cold storage archives are technically "retained" but not actually searchable, which is a distinction that matters exactly when it matters most. And building your own S3-plus-Athena setup to work around it turns your security team into a part-time data platform team, maintaining infrastructure instead of investigating threats.

None of these are failures of effort. They're the predictable result of pricing retention by the gigabyte and treating search performance as something that degrades gracefully at scale. It doesn't. Most platforms slow down and become vastly more expensive as data grows, so teams are pushed to sample, tier or discard data for speed and cost savings.

What Good Retention Actually Requires

Security telemetry is bursty by nature: a DDoS event, an incident, a sudden spike in edge traffic, are exactly the moments that generate the most data and matter the most. A retention layer only actually solves the problem if it can keep all of that data hot, affordable, and instantly queryable at that peak, not just once things settle back down.

What teams actually need is a destination built to hold up under live traffic surges, not just archive data after the fact. And when someone finally goes looking through months of retained history, they shouldn't have to leave the tool they already query every day or learn new syntax to do it.

Where Monad and Hydrolix Fit

Monad handles the collection, normalization, enrichment, filtering, and routing of security data across 350+ sources and destinations. What we needed on the other end was a destination, or data layer, that wouldn't buckle the moment traffic spiked, since that's exactly when the data matters most. Hydrolix is where we're sending it. Hydrolix comes from a background in analytics for streaming CDN data, serving as the main observability provider for the largest live events in the world like the Super Bowl and Olympics, where a slow query or a dropped event isn't an inconvenience, it's a failure. We picked a partner built to keep up under live traffic surges, not one built mainly for cold, low-cost archival storage.

With Hydrolix, the data that Monad normalizes, enriches, and routes lands ready to query the moment it's written, including during the traffic spikes and incidents that create the most data and matter the most. Hydrolix's compression (up to 50x, per their published numbers) and decoupled storage make it affordable to keep that data hot for years instead of days.

The other piece is how analysts actually get to it. Hydrolix ships an app, Hydrolix Search for Splunk, that lets analysts run standard SPL against Hydrolix-resident data directly from inside Splunk. Nobody has to learn a new query language or context-switch to a separate tool just to search further back than their SIEM was ever built to hold. That matters as much for an in-house security team as it does for an MSSP trying to give every customer a longer investigation window without asking each of them to pay for it.

Filtering is still a judgment call, and Monad's position on that hasn't changed: any pipeline that filters before data hits a destination is betting on what's safe to leave out. What's different here is that the bet doesn't have to be permanent. Data filtered out of the SIEM path can still land in Hydrolix intact, since Hydrolix's economics don't punish you for keeping the full picture, and its performance doesn't punish you for keeping it live.

"Every security team we talk to is making a tradeoff they didn't sign up for: security by budget. Reducing retention, rehydration delays when you least need them, and worse, throwing out data entirely, all this just to keep storage costs in check," said Michael Cucchi, Chief Marketing and Product Officer at Hydrolix. "That's not a data problem, it's an architecture problem, and as agentic SecOps approaches take hold, the architecture needs to change. Hydrolix is a critical data layer for this, built to keep years of telemetry hot and instantly queryable at scale. But we didn't have the security data. Monad makes sure that data arrives clean and ready to analyze, and Hydrolix makes sure it stays fast and searchable for as long as the business needs it. This is a best-in-class data pipeline tightly integrated to a best-in-class security data layer."

"Retention shouldn't be the thing security teams have to compromise on to keep their SIEM bill under control," said Christian Almenar, CEO and Co-founder at Monad. "With Hydrolix, teams send their SIEM the high-value data their detections actually run on. The full record goes to storage built for real-time scale. Nothing gets sampled or thrown away to make the budget work. That gives investigators the complete evidence they need to understand what happened, determine whether the threat has been contained, and prevent it from happening again."

What This Looks Like in Practice

Monad can normalize incoming telemetry to a consistent schema, including OCSF, so it's usable the moment it lands. It can enrich events with context before they reach a destination. And it can route the full, unfiltered record to Hydrolix while sending your SIEM only the normalized, high-value data your detections actually run on.

Organizations running Hydrolix alongside a traditional SIEM for long-term retention have reported up to 10x lower total cost of ownership compared to keeping that same volume of data inside the SIEM alone, with sub-second query performance regardless of how far back the search goes or how much is coming in at once.

Get Started

If your team is deleting or archiving telemetry today because your SIEM makes retention too expensive to justify, this is built for exactly that problem. Schedule a demo to see how Monad can route your data to both your SIEM and Hydrolix, and start keeping what you used to have to throw away.

‍