Bloo Datafabric · telemetry substrate
Build your own sovereign telemetry fabric.
Datafabric lets you build a sovereign telemetry fabric inside your own cloud: full-fidelity capture, long-term retention, and structured knowledge that stays under your control, with pricing that stays predictable year over year. It is the foundation every Bloo product stands on.
Overview
One fabric, every consumer.
AI agents, threat hunters, compliance and forensic teams, and applications all reason over the same fabric directly. No transformation layer, no export path, no second copy.
Ready for the next generation of connections.
Every consumer connects to the fabric on its own terms. AI agents reason over it, threat hunters and forensic investigators reconstruct causal histories from it, compliance teams audit against it, and applications read it directly.
One substrate carries them all, with nothing translated in between. Interoperable by design, and ready for the consumers that have not been built yet.
- AI agents
- Threat hunters
- Compliance teams
- Forensic investigators
- Applications
every consumer, one substrate · no transformation layer
Petabytes a day, without a ceiling.
Datafabric captures petabytes of telemetry every day. Infrastructure scales up and down with dynamic load conditions, so capacity follows the load instead of the other way around.
Surges are absorbed as they arrive, quiet periods release what they no longer need, and there is virtually no cap on how much the fabric can take in.
Ingest load
Nodes
× 06 active
nodes follow the load
PB / day
telemetry capture
None
ingestion cap
The fabric speaks agent.
A context layer and a data catalog sit over retained telemetry, so agents skip the transformation layer. No agent needs to know what data exists where, or which query language to speak: the context, the query, and the answer come from the fabric itself.
with context
Three interfaces, one fabric.
Agents connect over MCP, the flagship interface. Programmatic consumers use the API, and FILER exposes retained telemetry as a filesystem-style interface. Every interface reads the same fabric.
MCP · flagship
Model Context Protocol
Agents connect over MCP and reason over the fabric directly. Entity histories, causal links, and retained telemetry arrive as context, not as raw logs to be reconstructed.
API
Programmatic access
Tools and services consume the fabric through a stable API: the same structured telemetry, addressable from any pipeline, product, or workflow you already run.
FILER
Filesystem-style access
Mount and read retained telemetry like files. FILER exposes the fabric as a filesystem-style interface, so tools and agents read it with no API integration required.
Connectors
Capture from every domain.
Endpoint, cloud, network, identity, and application telemetry converges on the fabric through maintained connectors, captured at full fidelity into one substrate. You decide what is collected, and it all lands under your control.
- Cloud
- Applications
- Security
- Infrastructure
- Development
350+
connectors, maintained across every domain
Pipeline
Raw telemetry in, structured knowledge out.
Every record moves through six stages on capture. Collect brings it in and Extract structures it, Normalize gives it one shape, Enrich attaches context, Catalog makes it governed and discoverable, and Compress keeps years of it economical to hold.
parse on capture
Parsed and structured on capture
Telemetry is parsed and structured the moment it is captured, at full fidelity, with nothing sampled and nothing summarized away. The record enters the fabric already machine-readable, so structure is never deferred to query time.
- > Structured on capture, not on read
- > Full fidelity, nothing sampled
- > Every source lands machine-readable
attach context
Context attached to every record
Enrichment attaches context in place: entities, identities, causal links, and threat context. Raw events become statements about who did what, from where, and why it matters, so consumers never reconstruct meaning after the fact.
- > Entities and identities resolved
- > Causal links between events
- > Threat context attached in place
govern and discover
A governed, discoverable catalog
Retained telemetry becomes a governed, discoverable catalog. Teams, tools, and agents navigate what the fabric knows, under the access and retention policy you set, instead of guessing at what a storage bucket holds.
- > Governed, policy-aware access
- > Discoverable by consumers and agents
- > One catalog over the whole window
Hot Search
Years back, in seconds.
Hot Search is the most valuable capability in the fabric. Query telemetry from five or seven years ago as fast as yesterday's, with no archive to pull back, no rehydration to pay for, and no storage tiers to manage.
No tiers, no rehydration, no waiting.
Go back five years, seven years, as far as telemetry is retained in storage, and get an answer in seconds. Nothing is pulled back from an archive, nothing is rehydrated, and no budget is spent bringing history online. There is no hot, warm, or cold storage: no tiering at all, every day of the window is simply hot.
That reach matters most to agents. Because the whole lineage stays queryable, AI agents collect from the historic past, compare it with the present, and decide with the difference in view.
A timeline scrubber sweeps across eight years of retained telemetry; the result table below fills instantly for every year, with sub-second query times and no rehydration.
3 rows · 2019 · 0.31s · no rehydration
Two languages, one fabric.
Reason over historical telemetry through BQL, the Bloo Query Language, or through plain SQL. Both speak to the same fabric, the same retention window, and the same structured knowledge underneath.
The same question asked of the fabric twice: firewall telemetry from one source address over one time window, written in BQL, the Bloo Query Language, and in SQL.
the same question · the same fabric · the same answer
Pricing
Free to start, predictable to scale.
Every deployment is sized to your ingest once, and the price follows a gradual, predictable path from there. It never tracks how much your telemetry grows. Start free at 50GB a day.
Free tier
50GB / day
The full Datafabric, free, with up to 50GB of telemetry capture a day, deployed inside your own cloud.
Enterprise
Predictable
Sized to your ingest once. From there the price moves gently and predictably each year, independent of telemetry growth.
Deployment
Deployed inside your perimeter.
The same fabric on your infrastructure: AWS, Azure, GCP, or on-prem. Telemetry, retention, governance, and access stay inside your account, and nothing leaves.
AWS, Azure, GCP, or your own racks.
The same fabric deploys inside your perimeter on AWS, Azure, or GCP, or on-prem on your own hardware. One deployment model, your infrastructure, and nothing leaves.
- AWS
- Azure
- GCP
- On-prem
It runs itself.
Bloo manages itself. Provisioning, upgrades, scaling, and health are handled automatically inside your deployment, and the experience is remotely monitored, so issues are seen and resolved before they reach you.
You will not need a Bloo administrator. Data, retention, governance, and access stay inside your account the whole time.
- Handled by Bloo
- Provisioning · upgrades · scaling · health
- Experience monitoring
- Remote, continuous
- Bloo administrator
- Not required
- Stays inside your account
- Data · retention · governance · access
Questions
Frequently asked questions.
Is Datafabric a data lake?
No. A data lake stores raw logs and waits for queries. Datafabric is a telemetry substrate: it captures full-fidelity telemetry, retains it long-term inside your cloud, and structures it into organizational memory that teams, tools, and AI systems reason over. Bloo replaces your log data lake on day one.
Does telemetry leave my cloud?
No. Datafabric deploys inside your cloud account, and captured telemetry stays there. Retention, governance, and access control remain under your architectural control.
How is Datafabric priced?
Every deployment is sized to its ingest volume once, and the price follows a gradual, predictable path each year from there. Telemetry growth never reprices you, so capturing everything at full fidelity does not change the economics.
Do Vantage and SynthAI require Datafabric?
Yes. Every Bloo product stands on Datafabric. Vantage detects over it and SynthAI reasons over it, and neither keeps a second copy of your data.
What telemetry can Datafabric capture?
Endpoint, cloud, network, identity, application, infrastructure, and security telemetry through a catalog of 350+ maintained connectors, captured at full fidelity.
How much telemetry can Datafabric ingest?
Petabytes a day. Infrastructure scales up and down with dynamic load conditions, so capacity follows the load, and there is virtually no cap on how much the fabric can take in.
What is Hot Search?
Every day of the retention window stays hot. Query telemetry from five or seven years ago in seconds, with no storage tiers, no rehydration, and no restore jobs. The whole lineage stays queryable, for teams and for AI agents reasoning over the historic past.
What does the free tier include?
The free tier includes Datafabric with up to 50GB of telemetry capture a day, deployed inside your own cloud, at no cost. Full tier details are published as they are finalized.
How do agents connect to Datafabric?
MCP is the flagship interface: agents connect over Model Context Protocol and reason over the fabric directly. A context layer and a data catalog mean an agent never needs to know what data exists where, or which query language to speak: the fabric generates the query, the context, and the answer. Programmatic consumers use the API, and FILER exposes retained telemetry as a filesystem-style interface.
What deployment models are available?
Datafabric deploys inside your perimeter on AWS, Azure, GCP, or on-prem. With the Managed Experience, Bloo manages itself: provisioning, upgrades, scaling, and health are automatic, the experience is remotely monitored, and you will not need a Bloo administrator. Data, retention, governance, and access stay inside your account throughout.
Own your telemetry foundation.
Stand up a sovereign telemetry fabric inside your cloud today, and see what compounds on top of it.