Observed arrival · 2026-11-06
Trevane’s in-VPC log-folding proxy
Trevane is presented as a Rust proxy that folds repetitive telemetry before it reaches Datadog or Splunk, while retaining raw events in S3 Parquet.
- For
- Security teams spending $1k–$50k+ monthly on Datadog or Splunk
- Worth noticing
- On its BOTSv3 full-stream test, the page reports a 71.1% volume reduction and 3,752 of 3,752 attack-context events preserved.
Field notes
The page describes a three-part path: telemetry enters an in-VPC daemon, summaries go to Datadog or Splunk, and raw events are retained in customer S3 as Parquet. Its threat gate sends named actions such as StopLogging and DeleteTrail through without folding, while traffic spikes are unrolled to preserve ordinary alert behavior. The displayed benchmark results use public datasets, and the page cautions that customer-log results may differ.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue