Three new integrations combine federated threat investigation, unified operational visibility and flexible telemetry management to reduce data costs and help enterprises move beyond vendor lock-in.
CrowdStrike and Dynatrace have joined forces to challenge traditional Security Information and Event Management (SIEM) and observability platforms, introducing three integrations designed to accelerate threat investigations, simplify incident response and reduce the cost of managing enterprise telemetry.
Announced at Fal.Con Europe 2026 in Barcelona, the strategic partnership connects CrowdStrike’s Falcon platform with Dynatrace’s AI Observability platform and log management capabilities. The integrations aim to address a longstanding enterprise challenge: security and IT operations teams often work with disconnected platforms that require organisations to move, duplicate and pay repeatedly to analyse logs and telemetry.
The companies are proposing a different approach based on federated search, shared security and operational context, and flexible data routing. Rather than requiring organisations to centralise all their data in a single platform, the integrations allow teams to access relevant information across existing environments.
“Legacy SIEM platforms have turned security into a tax on data. CrowdStrike and Dynatrace are flipping that model on its head, helping customers move faster, spend less, and own their enterprise data destinies.”
— Daniel Bernard, Chief Business Officer, CrowdStrike
“Legacy SIEM platforms have turned security into a tax on data. CrowdStrike and Dynatrace are flipping that model on its head,” said Daniel Bernard, Chief Business Officer at CrowdStrike. He said the partnership combines AI-native cybersecurity and observability to help enterprises reduce costs, accelerate investigations and retain greater control over their data.
The first integration focuses on threat investigation without data movement. CrowdStrike Falcon enables federated searches across Dynatrace’s observability and log telemetry, allowing security teams to access application and infrastructure context without duplicating datasets or adding unnecessary ingestion costs. This can help investigators correlate endpoint threats with activity across applications and infrastructure.
The second integration brings security and operational intelligence together to improve incident response. Dynatrace combines CrowdStrike endpoint security telemetry with log, application and infrastructure insights. This unified visibility is designed to help teams identify root causes, assess business impact and accelerate the resolution of security incidents, breaches and service outages.
The third integration addresses data management costs through Bindplane by Dynatrace. The capability provides flexible routing of logs and telemetry between CrowdStrike and Dynatrace, helping organisations control unnecessary data movement, optimise ingestion and make better use of existing technology investments.
“Security and observability need to work together, not in silos, as AI-driven enterprises evolve towards more agentic operations.”
— Steve McMahon, Chief Customer Officer, Dynatrace
For CIOs and CISOs, the partnership addresses the growing convergence of security operations and IT observability. As enterprises adopt AI-driven applications and increasingly autonomous workflows, incidents can span endpoints, applications, infrastructure and cloud environments. Investigating these events through separate tools can slow response times and make it harder to establish the full operational and security impact.
Steve McMahon, Chief Customer Officer at Dynatrace, said the partnership provides organisations with the context needed to make faster decisions and automate operations with greater confidence. He emphasised that security and observability must work together as enterprises move towards more agentic operating models.
The companies are also deploying each other’s technologies within their own environments, putting the partnership into practice to strengthen internal operations.
The collaboration signals a broader shift away from data-heavy, siloed security and observability architectures towards interoperable platforms that allow organisations to retain control of their telemetry. For enterprises facing rising SIEM costs and increasingly complex digital environments, the ability to investigate threats across existing data sources without duplicating information could become an important consideration in modernising security operations.
