# How Onbe Replaced Dynatrace With One Air-Gapped Data Lake at ~1600% Better ROI

## Metadata

- **Canonical HTML**: https://ctrlb.ai/customers/onbe
- **Customer**: Onbe (financial services and payments)
- **Use case**: Observability and security analytics

## Behind Onbe's Air-Gapped Observability and Security with CtrlB

Onbe has facilitated well over $100 billion in payments for clients ranging from mid-market companies to the Fortune 500. Insurers settle claims through it, brands pay rebates and rewards, and platforms pay gig workers and contractors, by prepaid card, bank transfer, push-to-card, check, PayPal or Venmo.

Every failed payout is a person waiting on money. The telemetry behind those payouts carries the same sensitive context, so for Onbe, where that data lived mattered as much as how fast its teams could search it.

Observability and security had to run inside Onbe's own environment, and the return on that spend had to be far better than it was.

**This is where CtrlB came in.**

## The challenge: Two platforms, short windows, and data that could not leave

Onbe's application, infrastructure and WAF telemetry was split across Dynatrace and Azure Monitor. Investigating suspicious traffic meant working in two places and joining the results by hand while the incident was still open.

Retention windows were short, so the data needed to look back on an incident had often aged out. And every byte had to stay on-prem, inside a fully air-gapped environment, which rules out most observability platforms.

The challenge was to put all of it in one place, keep it searchable for longer, keep it inside Onbe's network, and get a much better return on the spend.

## The solution: Replacing Dynatrace and Azure Monitor with CtrlB

Onbe retired its Dynatrace and Azure Monitor stack and moved application, infrastructure and WAF telemetry into CtrlB, deployed on-prem and fully air-gapped.

Logs land schemaless, so new fields are queryable the moment they arrive at ingest. The AI Insight Engine flags error spikes, anomalous traffic and rare failure patterns across application, infrastructure and security logs before anyone writes a rule.

## The results: Better ROI, one data lake, nothing leaves the network

### ~1600% better ROI than the previous stack

Measured against the Dynatrace and Azure Monitor setup it replaced, Onbe gets roughly 1600% better return on its telemetry spend, with application, infrastructure and WAF telemetry all on CtrlB.

### Security and operations on one data lake

WAF logs sit beside application and infrastructure logs, so detection, hunting and investigation run against one platform instead of two.

### Long-term retention that stays searchable

Short retention windows are replaced with long-term cold archive storage. Archived telemetry stays fully searchable, not just stored.

### 100% on-prem and air-gapped

No telemetry leaves Onbe's environment. Storage, search and the AI Insight Engine all run inside it.

- **Markdown mirror**: Fetch `/customers/onbe.md` for this page as plain Markdown