Highlights
- Onbe's application, infrastructure and WAF telemetry was split across Dynatrace and Azure Monitor, with short retention windows.
- Onbe retired that stack and consolidated everything into one on-prem, fully air-gapped data lake on CtrlB.
- WAF logs now sit beside application and infrastructure logs, so detection, hunting and investigation run on one platform instead of two.
- Telemetry moves to long-term cold archive storage and stays fully searchable, not just stored.
- Onbe gets roughly 1600% better ROI than it did on its previous Dynatrace and Azure Monitor setup.
See it on your own data
Behind Onbe's Air-Gapped Observability and Security with CtrlB
Onbe has facilitated well over $100 billion in payments for clients ranging from mid-market companies to the Fortune 500. Insurers settle claims through it, brands pay rebates and rewards, and platforms pay gig workers and contractors, by prepaid card, bank transfer, push-to-card, check, PayPal or Venmo.
Every failed payout is a person waiting on money. The telemetry behind those payouts carries the same sensitive context, so for Onbe, where that data lived mattered as much as how fast its teams could search it.
Observability and security had to run inside Onbe's own environment, and the return on that spend had to be far better than it was.
This is where CtrlB came in.
The challenge: Two platforms, short windows, and data that could not leave
Onbe's application, infrastructure and WAF telemetry was split across Dynatrace and Azure Monitor. Investigating suspicious traffic meant working in two places and joining the results by hand while the incident was still open.
Retention windows were short, so the data needed to look back on an incident had often aged out. And every byte had to stay on-prem, inside a fully air-gapped environment, which rules out most observability platforms.
The challenge was to put all of it in one place, keep it searchable for longer, keep it inside Onbe's network, and get a much better return on the spend.
The solution: Replacing Dynatrace and Azure Monitor with CtrlB
Onbe retired its Dynatrace and Azure Monitor stack and moved application, infrastructure and WAF telemetry into CtrlB, deployed on-prem and fully air-gapped.
Return on investment
Logs land schemaless, so new fields are queryable the moment they arrive at ingest. The AI Insight Engine flags error spikes, anomalous traffic and rare failure patterns across application, infrastructure and security logs before anyone writes a rule.
See it on your own data
The results: Better ROI, one data lake, nothing leaves the network
The impact is measurable across return on spend, retention and data ownership.
~1600% better ROI than the previous stack
Measured against the Dynatrace and Azure Monitor setup it replaced, Onbe gets roughly 1600% better return on its telemetry spend, with application, infrastructure and WAF telemetry all on CtrlB.
Security and operations on one data lake
WAF logs sit beside application and infrastructure logs, so detection, hunting and investigation run against one platform instead of two.
Long-term retention that stays searchable
Short retention windows are replaced with long-term cold archive storage. Archived telemetry stays fully searchable, not just stored.
100% on-prem and air-gapped
No telemetry leaves Onbe's environment. Storage, search and the AI Insight Engine all run inside it.
Our application, infrastructure and WAF logs used to sit across Dynatrace and Azure Monitor, and short retention windows meant the data we needed had often aged out. Now all of it lives in one air-gapped data lake inside our own environment, and it stays searchable long after the old windows would have closed. It's changed how Onbe investigates incidents.