Pipeline detection is security analysis that happens while data is still moving through a collection or processing pipeline, before it is written to long-term storage or reviewed later. The pipeline may be a log collector, stream processor, message bus, or security agent that inspects events in real time.
This matters because earlier checks can raise alerts faster, reduce storage and indexing costs, and sometimes stop an attack sooner. In practice, defenders use pipeline detection to match patterns such as failed logins, suspicious command lines, or known malware indicators as events pass through. The tradeoff is that the pipeline becomes part of the security control surface: parsing, normalization, and rule tuning must be reliable, or attackers can hide in malformed data and defenders can drown in false positives. Pipeline detection is strongest when paired with later investigation in full log storage.