CrowdStrike and Dynatrace announced three integrations at Fal.Con Europe that let security teams query observability data without moving it into a central repository. The practical effect is that threat hunters can search logs and metrics where they already sit, rather than waiting for an overnight ingest job to pull everything into one place.<\/p>\n
For companies running large estates, the cost savings on data movement and storage are real. But the more interesting shift is what this does to team boundaries. Security analysts have traditionally worked in Falcon or Splunk; observability engineers have lived in Dynatrace or Datadog. These integrations assume a new profile: someone who understands both the security context and the observability context, and can write queries that span the two without waiting for a data engineer to build the pipeline.<\/p>\n
We have taken several mandates over the past six months where the original specification asked for a senior security engineer, then expanded mid-search to include observability fluency. The hiring managers did not initially realise they wanted a hybrid, until they saw what their shortlist could and could not do. Candidates who could only work in one toolset fell out; the ones who understood both workflows moved forward.<\/p>\n
This pattern will likely accelerate as more vendors adopt federated query models. The infrastructure that lets you search in place only delivers value if someone on the team knows what to ask. Companies in the DACH region running Dynatrace and CrowdStrike together should expect to compete harder for that profile, because the candidate pool is small and growing slowly.<\/p>\n