Derwent Labs

Derwent Labs is a security data normalisation platform that ingests security data from across an organisation's tool stack and maps it to the Open Cybersecurity Schema Framework (OCSF) before it reaches a SIEM or data lake. The platform operates as a pipeline layer between security data sources and downstream destinations. It offers 200+ pre-built connectors covering identity providers (Okta, Duo), endpoint detection tools (CrowdStrike), cloud platforms (AWS CloudTrail, Azure Monitor, GCP), CSPM tools (Wiz), vulnerability scanners (Tenable, Qualys), and more. All incoming data is automatically normalised to OCSF 1.7, a common schema that enables detections, dashboards, and queries to function consistently regardless of the originating source. Beyond normalisation, the pipeline supports in-flight enrichment — joining identity context from IdPs, asset posture from CSPM tools, and threat intelligence onto each event before it is forwarded. It also provides filtering capabilities to drop low-value events such as heartbeats and duplicate audit logs, with the platform achieving an average ingest reduction of 60–80%. Full-fidelity copies of raw data can be stored in object storage (e.g., S3) for historical replay against new detections. Destinations supported include Splunk, Microsoft Sentinel, Datadog SIEM, Elastic, Chronicle, Sumo Logic, and S3 data lakes. The platform supports dual-write to multiple SIEMs simultaneously, enabling migration or vendor diversification without data loss. Derwent Labs also offers a consulting service alongside its self-serve product. The platform is positioned for security operations teams looking to reduce parser maintenance, lower SIEM ingest costs, and write portable detections across multiple tools.