Tenzir

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Tenzir by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) only.

Then select Review + create and Create.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:tenzir:default:latest
az vm create \
  --resource-group <your-rg> \
  --name tenzir \
  --image sac1647283583153:tenzir:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Connect over SSH as azureuser:

ssh azureuser@<vm-ip>

The Tenzir client lives in /opt/tenzir/bin, which is added to your PATH automatically for login shells. In a non-login shell, add it explicitly:

export PATH="$PATH:/opt/tenzir/bin"

Print the Tenzir version and check the service state:

export PATH="$PATH:/opt/tenzir/bin" tenzir 'version' systemctl is-active tenzir-node

The output shows the Tenzir version (6.9.0) and active.

Tenzir stores events in its built-in columnar engine. The import operator writes the output of a pipeline into the store. This pipeline ingests a small set of example security events:

export PATH="$PATH:/opt/tenzir/bin" tenzir 'from {event: "ssh_login", user: "alice", src_ip: "203.0.113.10", outcome: "success"}, {event: "ssh_login", user: "bob", src_ip: "198.51.100.7", outcome: "failure"}, {event: "ssh_login", user: "root", src_ip: "198.51.100.7", outcome: "failure"}, {event: "http_request", src_ip: "203.0.113.55", path: "/admin", status: 403} | import'

In production, replace the inline from {...} source with a real input such as from_file, load_tcp, from_kafka or one of the many other built-in connectors. The rest of the pipeline stays the same.

The export operator reads events back from the store. Combine it with where, select and summarize to filter, project and aggregate. Tenzir pushes filters down into the storage engine for fast historical queries. Run these three pipelines:

export PATH="$PATH:/opt/tenzir/bin" tenzir 'export | where event == "ssh_login" and outcome == "failure" | select user, src_ip' tenzir 'export | where outcome == "failure" | summarize src_ip, failures=count()' tenzir 'export | summarize event, events=count()'

The first pipeline returns the failed SSH logins, the second aggregates failures by source IP, and the third counts every stored event by type.

The image ships a one-command, end-to-end self-test. It confirms that the node is active and loopback-bound, imports a set of events and queries them back. It fails loudly if the round trip returns nothing.

sudo /opt/sac/tenzir-roundtrip.sh

On success, it prints a round-trip summary and TENZIR ROUND-TRIP OK.