HN user
http://github.com/mavam
Why choose if you can have both? You can turn any MCP into an CLI with Pete's MCPorter: https://mcporter.dev.
Since I've just switched from buggy Claude Code to pi, I created an extension for it: https://github.com/mavam/pi-mcporter.
There are still a few OAuth quirks, but it works well.
Tenzir | Software Engineering & Sales | Remote (EU Timezones) | Full-time
Tenzir is building an open-core security data pipeline for the AI era. We empower defenders to collect, shape, and route security telemetry at scale. Our stack relies on C++23/26 and Apache Arrow for the core engine, with a modern TypeScript platform layer.
We are hiring for 4 key technical roles to join our distributed team (HQ in Hamburg):
- Software Engineer (Core Engine): Systems programming with C++23/26. Work on our pipeline language, query execution, database integrations, and streaming data processing with Apache Arrow.
- Software Engineer (Product): Full-stack TypeScript/Python focus. Build the control plane, platform APIs, and developer tools, AI workflows, and anything else that makes our engine accessible.
- Account Executive: Our first dedicated AE to own the full enterprise sales cycle. You'll work with complex deals in security and data infrastructure.
- Solutions Engineer: Lead POCs and post-sales implementation. You'll be the hands-on engineer ensuring customers succeed with complex data pipelines.
We are a remote-first team across European timezones. If you like solving hard data problems, we'd love to hear from you.
Not yet, but will do so soon at https://github.com/tenzir.
What's the startup latency? How long do I have to wait until Claude is operational?
For deploying Claude Code as agent, Cloudflare is also an interesting option.
I needed a way to run Claude marketplace agents via Discord. Problem: agents can execute code, hit APIs, touch the filesystem—the dangerous stuff. Can't do that in a Worker's 30s timeout.
Solution: Worker handles Discord protocol (signature verification, deferred response) and queues the task. Cloudflare Sandbox picks it up with a 15min timeout and runs claude --agent plugin:agent in an isolated container. Discord threads store history, so everything stays stateless. Hono for routing.
This was surprisingly little glue. And the Cloudflare MCP made it a breeze do debug (instead of headbanging against the dashboard). Still working on getting E2E latency down.
Tenzir | Remote - EU | open-core | Full-time | https://tenzir.com
Tenzir is hiring several key engineering roles to meet the needs in expanding the team. Our product: security data pipelines. From the data side, think of it as an Arrow-native, multi-schema ETL tool that offers optional storage in Parquet/Feather. From the security perspective, think of it as a solution for collecting, parsing, transforming, aggregating, and routing data. We typically sit between the data sources (endpoint, network, cloud) and sinks (SIEM, data lake).
Our open-source execution engine is C++20, our platform is SvelteKit and TypeScript. Experience with data-first frontend apps is a great plus. Open positions at https://tenzir.jobs.personio.de:
- Senior C++ Engineer
- (SecOps) Solution Engineer
We see this trend as well. And AWS Security Lake goes exactly there.
Right now, we‘re working on OCSF normalization in our pipelines to drop structured security telemetry in the right format where you need it. Like a security ETL layer.
We considered ClickHouse and DuckDB but struggled with making the execution engine multi-schema, e.g., more jq-like but still on top of data frames. So we started with a custom catalog and engine on top of Parquet and Feather that we will later factor into a plugin to transpile our query language (TQL) to SQL. The custom language because security people are not data engineers.
We're building something similar at Tenzir, but more for operational security workloads. https://docs.tenzir.com
Differences to Vector:
- An agent has optional indexed storage, so you can store your data there and pick it up later. The storage is based on Apache Feather, Parquet's little brother.
- Pipelines operators both work with data frames (Arrow record batches) or chunks of bytes.
- Structured pipelines are multi-schema, i.e., a single pipeline can process streams of record batches with different schemas.
Tenzir | Remote (EU) or Hamburg, Germany | open-core | Full-time | https://tenzir.com
Tenzir is hiring several key engineering roles to meet the needs in expanding the team. Our product: security data pipelines. From the data side, think of it as an Arrow-native, multi-schema ETL tool that offers optional storage in Parquet/Feather. From the security perspective, think of it as a solution for collecting, parsing, transforming, aggregating, and routing data. We typically sit between the data sources (endpoint, network, cloud) and sinks (SIEM, data lake).
Our open-source execution engine is C++20 (https://github.com/tenzir/tenzir), our platform is SvelteKit and TypeScript. Experience with data-first frontend apps is a great plus. Open positions at https://tenzir.jobs.personio.de:
- Fullstack Engineer
- Senior Frontend Engineer
- UI Designer
- Solution Engineer
We're developing TQL (Tenzir Query Language, "tea-quel") that is very similar to PQL: https://docs.tenzir.com/pipelines
Also a pipeline language, PRQL-inspired, but differing in that (i) TQL supports multiple data types between operators, both unstructured blocks of bytes and structured data frames as Arrow record batches, (ii) TQL is multi-schema, i.e., a single pipeline can have different "tables", as if you're processing semi-structured JSON, and (iii) TQL has support for batch and stream processing, with a light-weight indexed storage layer on top of Parquet/Feather files for historical workloads and a streaming executor. We're in the middle of getting TQL v2 [@] out of the door with support for expressions and more advanced control flow, e.g., match-case statements. There's a blog post [#] about the core design of the engine as well.
While it's a general-purpose ETL tool, we're targeting primary operational security use case where people today use Splunk, Sentinel/ADX, Elastic, etc. So some operators are very security'ish, like Sigma, YARA, or Velociraptor.
Comparison:
users
| where eventTime > minus(now(), toIntervalDay(1))
| project user_id, user_email
export
where eventTime > now() - 1d
select user_id, user_email
[#] https://docs.tenzir.com/blog/five-design-principles-for-buil...
Tenzir | Remote - EU | open-core | Full-time | https://tenzir.com
Tenzir is hiring several key engineering roles to meet the needs in expanding the team. Our product: security data pipelines. From the data side, think of it as an Arrow-native, multi-schema ETL tool that offers optional storage in Parquet/Feather. From the security perspective, think of it as a solution for collecting, parsing, transforming, aggregating, and routing data. We typically sit between the data sources (endpoint, network, cloud) and sinks (SIEM, data lake).
Our open-source execution engine is C++20, our platform is SvelteKit and TypeScript. Experience with data-first frontend apps is a great plus.
Apply at https://tenzir.jobs.personio.de for the following positions:
- Fullstack Engineer
- Senior Frontend Engineer
- UI/UX Designer
- SOC Solution Engineer
We are based out of Hamburg, Germany, and hire across EU time zones, stretching all the way to India.
The extra data type of unstructured/bytes is optional in that you don’t have to use it if you don’t need it. Just start with a table if that’s your use case.
In security, binary artifacts are common, e.g., to scan YARA rules on malware samples and produce a structured report (“table”). Turning packet traces into structured logs is another example. Typically you have to switch between a lot of tools for that, which makes the process complex.
(The “void” type is only for symmetry in that every operator has an input and output type. The presence of void makes an operator a source or sink. A “closed” pipeline invariant is one with source and sink, and only closed pipelines can execute in our mental model.)
We want to achieve something similar with our pipelines [1] by making the beginning and the end of the pipeline symmetric, giving you this flow:
1. Acquire bytes (void → unstructured)
2. Parse bytes to events (unstructured → structured)
3. Transform events (structured → structured)
4. Print events (structured → unstructured)
5. Send bytes (unstructured → void)
The "Publish" part is a combination of (4) and (5). Sometimes they are fused because not all APIs differentiate those steps. We're currently focusing on building blocks (engine, connectors, formats) as opposed to application-level integrations, so turnkey Reverse ETL is not near. But the main point is that the symmetry reduces cognitive effort for the user, because they worked that muscle on the "E" side already and now just need to find the dual in the docs.
[1] https://docs.tenzir.com/blog/five-design-principles-for-buil...
Author here: it’s describing how we built our pipeline engine. Technical content, presented in a form that I think is of interest to many HN users. I don’t think „ad“ is the correct term to refer to this. Can you elaborate what prompted your judgement?
For studying statistics, I put together a comprehensive cheat sheet: https://github.com/mavam/stat-cookbook
Hey, founder of Tenzir [1] here — We are building an open-core pipeline-first engine that can massively reduce Splunk costs. Even though we go to market "mid stream" we have a few users that use us as light-weight SIEM (or more accurately, just plain log management).
We are still in early access but you can browse through our docs or swing by our Discord.
Apache Arrow recently introduced ADBC for this.
Tenzir | Remote - EU | open-core | Full-time | Frontend Engineer | https://tenzir.com
At Tenzir, we're pioneering the future of open-source security operations with a revolutionary concept: SecDataOps. Our mission? To transform the foundational framework of cybersecurity operations. Our blueprint for this transformation is driven by an elegant philosophy—composable data flow pipelines.
Anyone can easily create powerful pipelines by chaining together operators, similar to Unix pipes or Powershell commands, with the difference that our operators are specially designed for security data operations use cases. You can unify dataflows by combining pipelines and build intricate security stacks that connect to the whole universe of security and data tools.
We are looking for a senior C++ Engineer with data engineering background, who would enjoy working on an Arrow-based dataflow execution engine.
https://tenzir.jobs.personio.de/
We are based out of Hamburg, Germany, and hire across EU time zones.
Tenzir | Remote - EU | open-core | Full-time | Frontend Engineer | https://tenzir.com
At Tenzir, we're pioneering the future of open-source security operations with a revolutionary concept: SecDataOps. Our mission? To transform the foundational framework of cybersecurity operations. Our blueprint for this transformation is driven by an elegant philosophy—composable data flow pipelines.
Anyone can easily create powerful pipelines by chaining together operators, similar to Unix pipes or Powershell commands, with the difference that our operators are specially designed for security data operations use cases.You can unify dataflows by combining pipelines and build intricate security stacks that connect to the whole universe of security and data tools.
We are looking for a junior/mid-level Frontend Engineer. Our main stack is SvelteKit with TypeScript. Experience building high-performance and/or data-intensive frontend apps is a great plus.
https://tenzir.jobs.personio.de/job/870111
We are based out of Hamburg, Germany, and hire across EU time zones.
Tenzir | Remote - EU | open-core | Full-time | Frontend Engineer | https://tenzir.com
At Tenzir, we're pioneering the future of open-source security operations with a revolutionary concept: SecDataOps.Our mission? To transform the foundational framework of cybersecurity operations. Our blueprint for this transformation is driven by an elegant philosophy—composable data flow pipelines.
Anyone can easily create powerful pipelines by chaining together operators, similar to Unix pipes or Powershell commands, with the difference that our operators are specially designed for security data operations use cases.You can unify dataflows by combining pipelines and build intricate security stacks that connect to the whole universe of security and data tools.
We are looking for a junior/mid-level Frontend Engineer. Our main stack is SvelteKit with TypeScript. Experience building high-performance and/or data-intensive frontend apps is a great plus.
https://tenzir.jobs.personio.de/job/870111
We are based out of Hamburg, Germany, and hire across EU time zones.
I wish there would be a Google Drive equivalent of this.
The heavy lifting of this is CISA's Malcom [1]. Unfortunately the blog posts only provides a non-linked bullet to it [2]. Seth Grover, the main driver behind Malcom, put a lot of effort over the years into creating a turnkey soc-in-a-box distro that works especially well for an network-first approach. Endpoint isn't neglected, but the focus on Zeek, Suricata, Arkime shows the primary visibility drivers. This is not surprising, because CISA also developed a bunch of custom ICS protocol dissectors that provide visibility (DNP3, Modbus, etc.). The list is impressive [3]. All of this is turnkey available by running Malcom. Especially for OT, where we have a lot more unmanaged black boxes and networks that you don't wanna actively scan (factories have been brought down this way), passively watching is a safe and powerful approach.
It's a bit unfortunate that Kali didn't give the props to Seth's project (not even an outbound link). Perhaps this was just an oversight, or a spotlight blog post is coming later, but I hope that the history of this gets properly acknowledged, because it's darn clear where this comes from.
[1] https://github.com/cisagov/Malcolm
Why does this use dot-based chaining as opposed to standard dplyr piping?
Is there a list somewhere with domain transactions > $10M? Curious to get a feel for the (subjective) value. There is probably a correlation in price with number of characters, vowels, etc.
Because it's related and a powerful alternative for those stuck in C++ land: The C++ Actor Framework (CAF) implements a combination of Akka and Erlang semantics.
Especially the type-safe actor abstractions saved us many bugs, e.g., sending an uint32 but trying to receive a uint64.
Tenzir | Remote - EU | Open-source | Full-time | https://tenzir.com
Tenzir is a seed-stage startup that builds an open-core SecOps data plane to enable evidence-driven detection, threat hunting, and investigation. Our stack consists of an indexed storage system and pipeline engine for dataflow processing on structured event data, VAST (https://vast.io). On top, we are building a Python app framework and a Svelte web frontend.
Our open positions include:
- Principal Product Designer: https://tenzir.jobs.personio.com/job/884074
- Security Engineer: https://tenzir.jobs.personio.com/job/870115
We are based out of Hamburg, Germany, and hire across EU time zones for engineering roles. For any questions, feel free to reach out to us at careers@tenzir.com.
Tenzir | Remote - EU | Open-source | Full-time | https://tenzir.com
Tenzir is a seed-stage startup that builds an open-core SecOps data plane to enable evidence-driven detection, threat hunting, and investigation. Our stack consists of an indexed storage system and pipeline engine for dataflow processing on structured event data, VAST (https://vast.io). On top, we are building a Python app framework and a Svelte web frontend.
Our open positions include:
- Principal Product Designer: https://tenzir.jobs.personio.com/job/884074
- Security Engineer: https://tenzir.jobs.personio.com/job/870115
We are based out of Hamburg, Germany, and hire across EU time zones for engineering roles. For any questions, feel free to reach out to us at careers@tenzir.com.
Tenzir | Remote - EU | Open-source | Full-time | https://tenzir.com
Tenzir is a funded seed-stage startup that builds the next generation SecOps data plane. Our mission is to make security operations plug-and-play. Our stack consists of indexed storage system and dataflow execution engine and for structured event data, VAST (https://vast.io). On top, we are building a Python-based app framework and web UI.
Our open engineering positions include:
- Frontend: https://tenzir.workable.com/jobs/2032753
- C++: https://apply.workable.com/tenzir/j/8F992DA512/
- Security: https://apply.workable.com/tenzir/j/E01CA0E577/
We are based out of Hamburg, Germany, and hire across EU time zones for engineering roles. For any questions, feel free to reach out to us at careers@tenzir.com.
Great to see more data engineering in the direction of SecOps.
We do something similar with VAST at https://vast.io. We’re still early, but especially live and retro detection of threat intel is what we are focusing on. Essentially operationalizing security content for detection and response, plus acquiring and extracting context of alerts and telemetry.
We have an experimental serverless deployment with Lambda and Fargate, but the majority of our users still collocate VAST near network sensors like Zeek and Suricata.
We’re running everything on top of Apache Arrow, storage of telemetry is now also Parquet. The idea is to do everything with open standards to minimize vendor lock-in.
Tenzir | Remote - EU | Open-source | Full-time | https://tenzir.com
Tenzir is a funded seed-stage startup that builds the next generation data plane for security operations centers. Our mission is to make security operations plug-and-play. Our stack consists of a database and execution engine for security event data, VAST (https://vast.io), for which we are building a Python-based app orchestration framework on top.
We currently look for a senior frontend engineer who helps us build out the fleet management, configurator, and cloud layer.
https://tenzir.workable.com/jobs/2032753
We are based out of Hamburg, Germany, and hire across EU time zones for engineering roles. For any questions, feel free to reach out to us at careers@tenzir.com.