Air-gapped by design
Collection, correlation and anomaly detection all run inside the perimeter, with no cloud dependency and no outbound control-plane connection. Sites that cannot reach the internet at all still get the full capability.
High-performance telemetry pipeline
Collect once from every layer: IT and OT, legacy and modern.
syslogGPUsOTELgNMIsnmpCLIK8s PVModbusagent and LLM traces50+ sources
FFWD’s anomaly engine and agent assurance depend on this cross-domain telemetry foundation. It is built on Rust, deployed privately, and priced so the bill doesn’t scale with your data.
Telemetry Pipeline is the new data foundation
AI infrastructure operations need a telemetry layer.
Built in Rust for AI-scale throughput
A two-tier architecture for the data volumes AI infrastructure generates, without the compute footprint of legacy stacks.
Log collector performance comparisons
50+
Native Source Formats
Ingest from anywhere, in any format, without format wrangling or bespoke collectors.
Cloud
AWS S3
SQS
SNS
Kinesis
CloudWatch
GCP PubSub
GCP Storage
Azure Blob
Azure Monitor
Messaging
Kafka / MSK
AMQP
MQTT
NATS
Redis
Pulsar
Splunk HEC
Infrastructure
Kubernetes
Docker logs
Host metrics
JournalD
Syslog
Exec
Monitoring
OpenTelemetry
Prometheus
StatsD
SNMP
NGINX
Apache
Postgres
Datadog
MongoDB
Okta
Data Sources
File
Socket
Stdin
HTTP Client
HTTP Server
Fluent
Logstash
dnstap
GNMI
WebSocket
GPU Telemetry
NVIDIA
Intel
AMD
Huawei
Broadcom
Apple
Qualcomm
AI Apps via MCP
Parse and configure collectors with AI agents: describe the source and FFWD writes the config.
Auto-Parse
~100 Grok templates ready out of the box, plus full support for custom formats.
Reshape data in flight, not at the destination
The most expensive place to clean up telemetry is after it arrives. FFWD's transforms run inside the pipeline, between collection and destination, so what reaches your analytics is already parsed, enriched, normalised, and right-sized for whatever consumes it.
- Parse Extract structured fields from any log format. FFWD's AI-assisted parser learns formats from samples, or configure parsing directly from your AI app via MCP. No regex skills required.
- Enrich Attach context from lookup tables, live APIs, geo-IP, asset inventories, or other in-flight streams. Add the metadata your analytics need to raw events.
- Cast field types Convert values to the types destinations expect: strings to integers, numbers to enums, JSON to columns.
- Normalise timestamps Mixed formats and timezones unified at ingest. ISO-8601 UTC, epoch, or your destination's flavour, picked once and applied everywhere.
- Reshape per destination Flat key=value for Splunk, tags for Datadog, nested JSON for Elastic and Parquet for the lake, all from one source and one pipeline.
- Reduce without losing signal Aggregate high-cardinality counters, deduplicate, sample with statistical fidelity, drop fields nobody queries. This cuts volume by 50%+ and keeps what matters.
- Merge and correlate Join related streams in-flight: pair request logs with response traces, correlate auth events with downstream API calls.
FFWD's transforms also cover conditional logic, regex, schema validation, custom scripting and multi-stream joins, configured visually or through your AI agents via MCP. If you can describe the transformation in plain terms, it's a single config block.
Stop paying SIEM prices to store noise
Splunk, Sentinel, QRadar and Chronicle all bill by the gigabyte ingested. FFWD drops, routes and right-sizes telemetry in flight, so you pay to analyse signal.
Typical reduction
50–80
%
less volume reaching your SIEM
1 TB/day in
→
200–500 GB billed
Drop the noise
Filter debug logs, health checks, heartbeats and duplicate events before they cross a metered boundary.
Route by value
Security-relevant events go to the SIEM. Everything else lands in low-cost object storage, still parsed and searchable, at a fraction of per-GB SIEM pricing.
Rehydrate on demand
Keep full-fidelity raw copies in Parquet on S3 for compliance and audit. Replay them into the SIEM only when an investigation actually needs them.
Visibility and retention stay the same, and the SIEM bill reflects what you query.
Bring agentic intelligence to OT and industrial
FFWD reads directly from the same industrial sources that already feed your existing SCADA. Apache PLC4X is integrated natively into FFWD’s adapter layer, providing direct support for Modbus, Siemens S7, EtherNet/IP, BACnet and more, alongside OPC UA, MQTT and the full 50+ connector set. The telemetry branches at the source: the existing PLC-to-SCADA control path continues untouched, while a separate, read-only stream feeds FFWD for collection, correlation and anomaly detection. FFWD can return scores and advisory tags as optional enrichment, but never enters the control loop. Nothing is replaced, and nothing needs to be re-certified.
Most telemetry products treat OT as an egress problem: get the data out to somewhere it can be processed. FFWD does the work in place.
Data sovereignty
Operational data never leaves the site. Only query results cross the boundary, so operators under strict residency or export constraints keep their data exactly where it is.
The agentic layer, on-site
An agent reasoning over plant telemetry belongs next to the data, not a round-trip away. With on-premises inference, the entire loop closes inside the fence, which is what makes a read-only agentic layer approvable in critical infrastructure.