Hunting without a data pipeline: six myths and the facts

Straight answer

Querying data in place does not retire the SIEM, does not make queries free, and does not mean every vendor names what it can reach. A mixed model can be the clearer one, ATT&CK-mapped rules are not a coverage view, and a fast deployment claim is still a claim until you time it.

Why this note exists

This site weights data reach without new ingestion highest, at 25%, because of the question it answers. That makes it worth being precise about what hunting on existing data does and does not mean. Each myth below is checked against the public pages of the six vendors we compare.

Myth 1: hunting in place means the SIEM goes away

Fact: in every tool on this site, the SIEM is one of the platforms queried or connected to. Mars Security's hunting guide describes a federated hunt that "reads from the SIEM alongside the EDR, identity provider, and cloud logs" and says "The SIEM keeps its compliance and retention jobs." Anvilogic describes one query across platforms including Splunk and Sentinel. The SIEM stays a data platform the hunting tool reads.

Myth 2: if the data is not copied, the queries cost nothing

Fact: a query sent to a platform runs on that platform's compute. Anvilogic's public calculator exists to estimate data-lake compute and storage costs, and it states that its savings figures exclude Anvilogic's own licensing. Ask every vendor how many queries it will run and how that volume is limited.

Myth 3: every no-ingestion vendor tells you what it can reach

Fact: some do and some do not. Mars Security's press release names the sources it queries, and Anvilogic names four SIEM platforms, six data lakes and three object stores. Vega describes "No migration, ingestion, or egress", but its connectors page names no platforms, which is why it scores 3 of 5 on data reach. A named list is something you can check.

Myth 4: a mixed model is a weaker model

Fact: Artemis Security says plainly that hot-path data is ingested and high-volume data is queried where it lives, and its connector page shows which platforms fall on each side. For a buyer that clarity is useful. It scores lower on data reach here, 3 of 5, only because this site's question asks for no new ingestion; for a team happy to ingest some data, the published split may be exactly what they need to plan.

Myth 5: ATT&CK-mapped rules mean you can see your coverage

Fact: mapping is a property of each rule; coverage is what you get when the mapped rules are added up against the ATT&CK matrix. Mars Security describes ATT&CK-mapped rules, but we found no public coverage view, so it scores 2 of 5 on coverage measurement. Anvilogic, Cotool and Vega describe coverage scoring or coverage views. See What an ATT&CK coverage claim should show.

Myth 6: a stated deployment time is a measured one

Fact: every deployment time on a vendor page is the vendor's claim. Mars Security states deployment in hours; Artemis Security states connectors live in under an hour and real cases inside 48 hours. We score these as published and label them as claims. The only way to measure one is to time it on your own data, as described in Running a proof of concept for hunting on existing data.

What to take from this

Hunting on existing data is a real design choice with real benefits: no second copy of the data and no new pipeline to build. It also has costs and unknowns that vendor pages do not always spell out. Read the reasons behind each data reach score on the matrix, and use What 'no ingestion' means on a vendor page for the five checks to run before signing.

Sources

Editorial assessment · Desk research from public vendor material, last reviewed September 2026

Six myths about hunting without a new data pipeline