Loading story…
Engineering teams are reporting rapidly rising observability costs driven less by vendor pricing alone than by poor telemetry governance, excessive data generation, and limited visibility into which signals are actually useful. One account describes large organizations spending heavily on observability while manually chasing cost spikes, dropping large volumes of logs, and still struggling because core metadata such as service.name is often missing across production telemetry. The common problem is that teams keep generating and storing high-volume signals without clear ownership, quality controls, or confidence that the data supports incident response and operations.
OpenTelemetry pipeline management is presented as a related operational gap: teams often modify collector configurations directly in production because they lack a safe way to preview the impact of filtering or reducing telemetry. A proposed dry-run mode for the OpenTelemetry Collector aims to address that by combining static config analysis, live metrics, and an ephemeral OTLP tap to evaluate filter behavior before changes are enforced. One other article about failure handling in multi-agent review systems is not related to observability or telemetry cost management and should be excluded from this story.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
An article in The New Stack argued that rising observability bills are often caused by poor telemetry governance and low-quality instrumentation, including duplicate logs, noisy auto-instrumentation, high-cardinality metrics, and leakage of sensitive data into telemetry pipelines. It recommended governance controls such as instrumentation scoring, pre-production review, compliance visibility, and PII detection to improve signal quality at the source.
Canonical built Signal Studio, an open-source tool designed to add diagnostic and dry-run-like capabilities to OpenTelemetry Collector pipelines so teams can assess filter and pipeline changes more safely in production-like environments. The tool combines static YAML analysis, read-only live metrics inspection, and optional in-memory OTLP sampling while remaining read-only and non-persistent to reduce operational and security risk.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two practitioner write-ups highlighted that **security telemetry is both essential and frequently misleading** when it is incomplete, poorly scoped, or misinterpreted. A SANS ISC guest diary describing hands-on operation of a *DShield* internet-exposed honeypot reported collecting **~8 million logs from ~14,000 unique IPs** over several months, emphasizing that most activity is automated “noise” and that meaningful conclusions depend on collecting the *right* data and applying a disciplined methodology to correlate events and preserve investigative breadcrumbs. A separate Detection Engineering Weekly issue reinforced the theme that **“there is no detection without telemetry,”** while cautioning that detection outcomes are constrained by what logs actually capture and how trustworthy/observable that telemetry is. The newsletter also contained unrelated promotional material (e.g., hiring links and a webinar pitch), but its substantive security content aligned with the same core message: detection engineering must account for telemetry coverage and quality, because missing or deceptive logs can cause false confidence, missed detections, or incorrect incident narratives.
Jul 3, 2026
Major security and observability vendors are accelerating the consolidation of the security data pipeline platform (SDPP) market through high-profile acquisitions, such as Palo Alto Networks acquiring Chronosphere for $3.3 billion and CrowdStrike acquiring Onum. These moves are reshaping the security operations center (SOC) landscape by making data pipelines the primary control plane, responsible for ingestion, normalization, enrichment, and routing of security telemetry. While these integrations promise improved data management and cost efficiency, they also raise concerns among practitioners about vendor neutrality and migration challenges as the market shifts toward fewer, more integrated solutions. In parallel, organizations like InfluxData are moving away from reliance on third-party SaaS security tools after experiencing blind spots and delayed breach detection, as highlighted by their experience with the Codecov breach. By developing in-house platforms such as DiSCO, powered by time-series telemetry, they aim to achieve greater visibility and control over their security monitoring and supply chain observability. This trend underscores a broader industry movement toward both consolidation of commercial pipeline solutions and the adoption of custom telemetry-driven monitoring to address gaps left by traditional SaaS offerings.
Jul 12, 2026
Security teams continue to face elevated risk from **network edge device vulnerabilities** and legacy/slow-to-patch infrastructure, with threat actors actively exploiting exposed perimeter systems and benefiting from limited vendor cooperation and uneven firmware update practices. Discussion also highlighted defensive approaches aimed at improving early warning and containment—particularly stronger monitoring/detection around edge assets and the use of deception mechanisms such as **canary tokens** to surface exploitation attempts sooner. Separately, security operations practitioners are emphasizing that many organizations are effectively **“flying blind”** due to incomplete or provider-controlled logging in cloud/SaaS environments, which can undermine detection engineering and incident response when platforms change telemetry or access patterns. The coverage also pointed to emerging efforts to benchmark **LLMs for defensive SecOps workflows** and shared practitioner perspectives on how large platforms (e.g., Reddit) approach threat detection, reinforcing that visibility and measurable detection capability are central constraints even when tooling and automation improve.
Jun 29, 2026