Overview

Pipeline Intelligence is a suite of recommendations and AI-powered features that help you understand your telemetry data and automate your pipeline configuration.

Pipeline Intelligence

Pipeline Intelligence allows you to avoid manual configuration and complex OTTL syntax, and instead use natural language descriptions and intelligent data analysis to quickly build and optimize your pipelines.

With Pipeline Intelligence, you can:

• Automatically identify and categorize log types from your telemetry data

• Standardize log types for Google SecOps ingestion

• Validate that your logs will parse correctly in Google SecOps

• Generate components using natural language

• Parse complex telemetry into structured data

• Get intelligent recommendations for pipeline improvements

• Migrate existing configurations from OpenTelemetry, Chronicle Forwarder, and Splunk Universal Forwarder

• Get recommendations based on continuous monitoring across all your pipeline data with Global Pipeline Intelligence

Global Pipeline Intelligence

Global Pipeline Intelligence applies the same intelligence across all your pipeline data, continuously. Recommendations surface as notifications based on what's actually flowing through your pipelines, without you having to open a snapshot. Learn more about Global Pipeline Intelligence here.

AI Features

Pipeline Intelligence AI features are only available for Enterprise, Bindplane Enterprise (Google Edition), and Honeycomb licenses.

Some Pipeline Intelligence features use generative AI to analyze your data and produce configurations. Others, like the Chronicle Forwarder and Splunk Universal Forwarder migrator, use deterministic logic with no AI involved. The table below shows which features use AI.

Feature	Capability	Provider(s)	Model	Data Used for Model Training?	Uses Generative AI?
Generate Processors	Processor generation	Google Gemini	gemini-2.5-flash	No	Yes
Generate Windows Events XML Query	Query generation	Google Gemini	gemini-2.5-flash	No	Yes
Get Log Types	Log classification	Google Gemini	gemini-2.5-flash-lite	No	Yes
Get Log Type and Body Format	Log classification	Google Gemini	gemini-2.5-flash-lite	No	Yes
Migrate Configurations (Chronicle Forwarder)	Config conversion	—	—	No	No
Migrate Configurations (OTel)	Config conversion	Google Gemini	gemini-2.5-flash	No	Yes
Migrate Configurations (Splunk Universal Forwarder)	Config conversion	—	—	No	No
Parse Field	Field parsing	Google Gemini	gemini-2.5-flash	No	Yes
Parse with Regex	Regex generation	Google Gemini	gemini-2.5-flash	No	Yes
Pipeline Intelligence Recommendations	Processor recommendations	Google Gemini	gemini-2.5-flash	No	Yes
Standardize Log Type for SecOps	Processor generation	Google Gemini	gemini-2.5-flash	No	Yes
Validate SecOps Parser	Parser validation	—	—	No	No

How your data is used

When AI features are enabled, only the minimal input data needed to generate a response (such as log structure and content snippets) is sent for processing. We do not store AI inputs after processing. Data is used solely during transmission to generate a response and is not retained.

Bindplane uses an internal AI observability tool to evaluate whether AI features are performing correctly. Only metadata such as token counts and timing is transmitted, never the content of your data.

Pipeline Intelligence AI features are off by default. Nothing changes in your environment until an org admin explicitly enables them.

For full details, please review our Privacy Policy and EULA.

Best Practices

• Always review AI-generated processors before deploying to production. While AI is designed to create correct configurations, it may make mistakes.

• Things to verify:

  • Field paths match your actual data structure

  • Conditions and filters work as expected

  • Processor order is correct for your use case

• Begin with simple requests and gradually add complexity.

• Use multiple Pipeline Intelligence features together:

  • Use "Get Log Types" to identify log types

  • Use "Standardize Log Types for SecOps" on those log types if needed

  • Use "Parse Field" to parse fields if needed

  • Use "Generate Processors" to add any transformations