Chronosphere details mechanics of modern approach to observability
The observability platforms market is expanding.
Dynatrace is still there, as is Datadog, Elastic and New Relic. All the while, Grafana is making more noise than your average Splunk, Honeycomb or Coralogix… and of course IBM is in the mix too, not least down to the fact that IBM makes one of pretty much everything in the enterprise software stack.
Then there’s Chronosphere, part of Palo Alto Networks since the very start of this year.
Chronosphere is a Kubernetes-native cloud observability platform designed to help software engineers manage, analyse and control massive volumes of telemetry data and enable teams to apply AI agents to their stack that can now find and fix security and IT issues automatically.
Not to be confused with chromosphere (the second layer of a star’s atmosphere), Chronosphere co-founder and CEO Martin Mao now goes by the title of SVP, GM of observability at Palo Alto Networks.
Beat the data tax
Mao and team say that the Chronosphere Telemetry Pipeline remains available as a standalone solution, enabling organisations to eliminate the “data tax” associated with modern security operations.
“By acting as an intelligent control layer, the pipeline can filter low-value noise to reduce data volumes by 30% or more and has been shown to require 20x less infrastructure than legacy alternatives. This will be key to Palo Alto Networks’ Cortex XSIAM strategy as they transition to autonomous, AI-driven operations,” noted a corporate statement.
Platformisation = (SIEM+XDR+SOAR)
NOTE: The XSIAM strategy features so-callled “platformisation” procedures to consolidate legacy Security Information and Event Management (SIEM), Extended Detection and Response (XDR) and Security Orchestration, Automation, and Response (SOAR) into a single AI-driven Security Operations Centre (SOC). By integrating Chronosphere’s telemetry pipeline, the strategy aims to optimise data costs for real-time, automated threat detection and autonomous remediation.
Distributed microservice environments produce a massive amount of metrics, logs, and traces – and legacy monitoring platforms frequently tie their pricing structures directly to ingestion volumes.
Mao blogged this month to explain more his team has designed the Chronosphere Control Plane to solve this exact problem i.e. giving teams the tools to proactively manage telemetry data and prevent escalating costs.
“Our platform actively helps organisations right-size their data, while preserving the visibility they need. On average, our customers optimise their observability data volume by 89%, ensuring they retain valuable operational signals without the financial burden of unmanaged data ingestion,” wrote Mao.
He also notes that the company is seeing that leading AI-native companies also need a cost-effective, highly-scalable observability solution, given the volumes of data they emit and the scale of growth.
Chronosphere already provides observability for two of the top five leading AI frontier labs.
Temporal Knowledge Graph
“At [our] foundation is our Temporal Knowledge Graph, which connects all the telemetry data across a company’s infrastructure, applications and business operations. It also accounts for user input and the institutional knowledge that is collected over time (e.g. investigation notebooks, or comments) to build a living, queryable model of how a company’s overall system behaves. We’ve observed that the more complete this Knowledge Graph is – meaning the better the system is presented – the better the results,” blogged Mao.
He claims that what makes this approach differentiated is that it can contextualise data regardless of format or schemas.
Mao: Telemetry data can be notoriously messy; we sift through ahead of time, ensuring our agents run on cleaner data live.
This sector of the market is more normally populated with tools that work as follows:
- Platforms that use proprietary integrations as their source of data – these solutions may struggle to bring context to custom instrumentation, which ends up being the majority of observability data.
- Platforms that see the customer enforcing strict, consistent schemas across their observability data, which may be impractical in large organisations.
Mao says Chronosphere connects data across varying schemas and naming conventions, and also uses AI to add meaning and context to the raw data.
“Telemetry data can be notoriously messy, so we sift through as much as possible ahead of time, ensuring our agents run on cleaner data live,” said Mao. “The more you can pre-compute ahead of the time, the less time agents have to spend determining how to navigate the data on the fly.”
He says that when building the company’s Knowledge Graph, the team “continuously work” to understand what log labels tend to show up in the environment and what queries historically delivered actionable insights.
With this information, the sub-agent knows to look for the appropriate labels in the logs. It might also, for example, know to avoid searching for ERROR logs, if a specific customer rarely uses them.
The road ahead
“Looking ahead, the software landscape is shifting as AI increasingly produces code and automates development at an unprecedented scale. The next frontier is to counter-balance this influx of AI-generated output by leveraging AI to resolve system issues without human involvement,” concluded Mao.
One of the firm’s next areas of focus is pre-computing environmental data (cleansing, organising and structuring telemetry data before storing it) that has a high likelihood of being relevant and durable before it’s stored in the Knowledge Graph.
That way, when an alert fires, sub-agents can gather context and draw information from the Knowledge Graph in a manner that balances both quality and speed.
