Selim Seynur

Padas Motion is our security streaming product. It shapes telemetry while the data is still moving (filter, parse, aggregate, detect, route) and hands cleaner, higher-value events to the tools you already run.

Motion is also the first chapter of a longer arc, it shapes the data while it moves, then Chronos allows organizations to own the context built from it. Motion is the part you can run today.

This post is the introduction; we focus on what's in v0.1.0, how a pipeline is put together, and what a PDL task actually looks like.

After 25 years in information security, I've seen my fair share of vulnerabilities come and go. There's one classic that never seems to fade away: the humble buffer overflow. From my early days writing C/C++ code and hunting down memory leaks, to performing white hat hacking and teaching security training with sample overflow exploits, I've witnessed firsthand how this seemingly simple memory management issue can cause major problems. Buffer overflows aren't just academic exercises or relics from the 1990s; they're still very much alive in today's high-performance systems, and they're particularly relevant when building software that need to handle millions of events per second reliably.

A buffer overflow happens when a program writes more data into memory than the allocated space allows. Instead of stopping, the excess data spills into adjacent memory. That corruption can cause crashes, data leaks, or — in the most dangerous cases — remote code execution.

In today's rapidly evolving cybersecurity landscape, security teams face unprecedented challenges. They're dealing with exponential growth of security data, alert fatigue from increasingly sophisticated adversaries, and a critical shortage of skilled analysts.

The goal for security operations centers (SOC) has remained largely the same: lower MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond), reduce false positives, and scale as needed. However, achieving these goals has become exponentially more difficult.

In this context, security telemetry pipelines aren't just enhancements—they're becoming a necessity. In a world where terabytes of data flood your SIEM daily, real-time context (e.g., reasoning and detection logic with security ontologies) and intelligent filtering can no longer be optional.