CrowdStrike to acquire Onum, boosting Falcon SIEM with real-time AI

CrowdStrike has announced its intention to acquire Onum, a business focused on real-time telemetry pipeline management.

The deal is set to expand CrowdStrike's Falcon Next-Gen SIEM, aiming to establish a comprehensive data foundation for agentic security and IT operations, and to remove friction in customer onboarding processes while introducing enhanced autonomous detection features.

Acquisition strategy

According to CrowdStrike, incorporating Onum's technology will aim to support Falcon Next-Gen SIEM in assisting modern security operations centres (SOCs) with managing large and complex data environments, optimising costs and performance, and enabling organisations to respond more swiftly to incidents.

"Our Next-Gen SIEM is the engine that powers the modern SOC, and data is the fuel that makes the engine run. Onum is both a pipeline and a filter, which will stream high-quality, filtered data directly into the platform to drive autonomous cybersecurity at scale. This is how we stop breaches at the speed of AI while giving customers complete control over their entire data ecosystem – well beyond cybersecurity," said George Kurtz, CEO and founder of CrowdStrike. 

Onum's technical capabilities

Onum, founded on a proprietary stateless, in-memory architecture, is positioned as a technical complement to Falcon Next-Gen SIEM. Its platform is marketed as capable of onboarding data quickly, providing clients with control over their security and observability data, and facilitating AI-powered detections on third-party data sources directly in the data pipeline, before data enters the Falcon platform.

The company has highlighted three core areas where it claims Onum provides advantages. Firstly, in terms of speed, Onum is stated to deliver up to five times more events per second compared to its nearest competitor and is designed to process security and observability data in real-time as opposed to the conventional batch and store approach.

Secondly, Onum is presented as providing cost benefits through intelligent optimisation. Its smart filtering functionality is intended to reduce data storage costs by up to 50 percent. Lastly, the platform's real-time pipeline detection capabilities are claimed to enable up to 70 percent faster incident response with 40 percent less ingestion overhead, starting detection as data travels through the pipeline before entering Falcon.

Addressing data migration challenges

CrowdStrike and Onum assert that historically, migrating data into next-generation security information and event management systems has been a lengthy and complex process. According to the announcement, third-party tools were often required, leading to additional friction and cost for organisations.

The integration of Onum's solution is intended to address this bottleneck by providing native data streaming and in-pipeline detection capabilities within the Falcon platform, with the aim of reducing reliance on separate tools and removing barriers from the data onboarding process.

Pedro Castillo, founder and CEO of Onum, commented on the rationale behind the deal and the future direction for the business within CrowdStrike.

"Onum was founded on the belief that pipelines should do more than transport data, they should transform data into real-time intelligence. By joining CrowdStrike, we can deliver this vision at unprecedented scale to accelerate SOC transformation on a global scale. I'm incredibly proud of what our team has accomplished in defining real-time telemetry pipeline management, and we look forward to bringing that innovation to the Falcon platform," said Pedro Castillo, founder and CEO of Onum. 

SIEM market context

CrowdStrike is making this move as businesses increase investment in security operations and observability tools that address the challenges of growing data volumes and evolving threat environments. The acquisition of Onum is stated to further the adoption of Falcon Next-Gen SIEM among organisations seeking scalability and automation in their security infrastructure.

Specific financial terms of the transaction have not been disclosed, and the deal remains subject to customary closing conditions. Both companies have indicated their intention to work towards a smooth integration of technology and operations, with CrowdStrike aiming to deliver expanded detection capabilities and operational benefits to existing and prospective customers.