Normalized claim
Cost: 35% decrease
Saved 35 percent on COGS as of Q3 2024.
Trellix: Using Amazon OpenSearch Service to improve security analytics ingestion and enable genAI
Use case typeGrowth analyticsUpdated Jun 13, 2026
Trellix migrated its self-managed Elasticsearch workloads on Amazon EC2 to Amazon OpenSearch Service to reduce operational cost and improve the reliability and scalability of its security analytics platform. The company ingests and stores billions of daily customer logs and makes them searchable through a web interface for auditing, filtering, malware detection, and other security uses. Trellix collaborated with AWS and used OpenSearch Ingestion pipelines, Amazon S3, Amazon SNS, Amazon SQS, Amazon CloudWatch, and Amazon Managed Grafana to support varied data types, monitoring, and visualization. The migration completed with no downtime and minimal customer impact, and Trellix also positioned the platform to support generative AI use cases such as Trellix Wise using Amazon Bedrock and Amazon Nova Foundation Models.
- Organization
- Trellix
- Industry
- Tech & Comms
- Location
- United States
- Published
- May 2026
Reported outcomes
Time: 8–10 hours
Time & speed
Time: 8–10 minutesTime: 9 minutes
Why do we believe this?Outcome claims, sources, and evidence checks
Normalized claim
Quantified impact: 40% increase
Increased data processing volume by 40 percent.
Normalized claim
Time: 8-10 hours decrease
Reduced infrastructure management from 8-10 hours per week to 30-60 minutes.
Normalized claim
Time: 8-10 minutes decrease
Reduced infrastructure management from 8-10 hours per week to 30-60 minutes.
Normalized claim
Time: 9 minutes
Recovered in 9 minutes with no data loss in a disaster recovery test.
Normalized claim
Quantified impact: 90% decrease
Reduced operational indexing issues by 90 percent.
Why do we believe this deployment?Customer identity, provider attribution, maturity, and source checks
- Customer
- Trellix
- Provider
- AWS
- Maturity
- Scaled Production
- Linked source
- AWS Solutions Case Study
The security analytics platform needed to ingest varied and dynamic customer data reliably at scale
Customer identity supportedSource describes one deploymentMaturity supported
Primary read
Use case focus
Showing 3 of 4
- 1Security analytics
- 2Search and analytics modernization
- 3Infrastructure modernization
- Completed a proof of concept and migrated to Amazon OpenSearch Service.
- Re-architected OpenSearch domains and OpenSearch Ingestion pipelines with AWS engineering support.
- Used Amazon S3 for storage, Amazon SNS and Amazon SQS for data flow, and Amazon CloudWatch plus Amazon Managed Grafana for monitoring and visualization.
- Adopted Amazon Bedrock and Amazon Nova Foundation Models for future generative AI capabilities in Trellix Wise.
Recovered in 9 minutes with no data loss in a disaster recovery test.
Architecture
Trellix moved from self-managed Elasticsearch on Amazon EC2 to Amazon OpenSearch Service. The new architecture stores ingested data in Amazon S3, uses Amazon SNS to send data to Amazon SQS, and then feeds OpenSearch Ingestion pipelines. Amazon CloudWatch and Amazon Managed Grafana provide observability and operational visualization. The article also notes Amazon Bedrock and Amazon Nova Foundation Models for emerging generative AI use cases.
Sources & evidence1
Evidence: Medium65/100Evidence strength
- Customer explicitly identified
- Deployment status explicitly supported
- Primary source available
- Quantified outcome available
- Technical implementation details available
Type: Customer StoryPublished: May 27, 2026Publisher: AWSEvidence: PrimaryConfidence: High
AI-generated summary. Verify important details with the linked sources before relying on this case.
Explore related AI use cases
Customer evidence
Provider evidence
Browse the catalog
Was this useful?
Community
Comments
No published comments yet.