Sovereign MDR with OCSF Data Pipelines: DCSO and Tenzir Publish Joint Solution Brief

How can organizations leverage Managed Detection and Response (MDR) services without giving up control over their security telemetry? This question is at the heart of a new joint Solution Brief from DCSO and Tenzir, which outlines how a customer-controlled OCSF data pipeline can be combined with DCSO’s MDR services.

Modern security operations depend on high-quality telemetry to reliably detect, analyze, and respond to cyber threats. At the same time, organizations increasingly need to maintain sovereignty over sensitive security data while preserving flexibility within their security architecture.

The joint approach from DCSO and Tenzir addresses these requirements. Tenzir acts as the security data control plane, handling the ingestion, normalization, and governance of telemetry data, while DCSO delivers Managed Detection and Response services including 24/7 monitoring, threat analysis, actionable recommendations, and incident response.

At the core of the solution is the Open Cybersecurity Schema Framework (OCSF). By normalizing telemetry from diverse data sources into a common schema, organizations gain a structured and portable data foundation that can be leveraged not only for MDR services, but also across SIEM platforms, data lakes, and future AI-powered SOC environments.

What You Will Learn in the Solution Brief

• How to build a customer-controlled security data pipeline
• The role of OCSF in interoperability and data portability
• How telemetry from endpoint, cloud, network, identity, application, and SaaS environments can be consolidated
• How DCSO MDR operates on an OCSF-normalized data foundation
• How threat intelligence, detections, recommendations, and response actions can be integrated into a closed-loop workflow
• Why data ownership and sovereignty are becoming critical requirements for modern security operations

Who Should Read This Solution Brief?

This Solution Brief is particularly relevant for:

• SOC and Security Operations teams
• Detection Engineers
• Security Architects
• SIEM and Security Data Platform owners
• MDR and Threat Detection decision-makers
• Organizations evaluating OCSF-based security architectures

Driving Open and Sovereign Security Architectures

The collaboration between DCSO and Tenzir combines advanced detection and response capabilities with an open and interoperable approach to security telemetry. By leveraging open standards such as OCSF, organizations gain greater transparency, flexibility, and control over their security data—while still benefiting from professional MDR services.

As security teams continue to modernize their operations, open standards, data portability, and sovereign security architectures will play an increasingly important role. The joint Solution Brief demonstrates how these principles can be put into practice today.