Telemetry Engineering As A Security Architecture Discipline: A Design Framework For Detection-Ready Multi-Cloud Pipelines

Abstract

Security telemetry fails detection for a structural reason: logs are collected for retention and compliance rather than engineered around the signals an analytic actually requires. Critical fields are absent, schemas are inconsistent across providers, delivery is delayed, and source failures stay invisible. This paper argues that telemetry engineering should be treated as a security architecture discipline in its own right, which changes the design objective from ingesting more data to delivering dependable detection evidence. We define detection readiness as a design property of a pipeline rather than a retrospective judgment of a security operations team, and present a provider-neutral framework that makes multi-cloud telemetry explicitly detection-ready. The framework contributes three artifacts: a twelve-stage pipeline design method that works backward from a detection objective; a seven-layer cross-cloud signal taxonomy with a common detection schema that normalizes semantics without destroying provider-specific evidence; and Telemetry Detection Readiness (TDR), a five-dimension construct combining coverage supportability, signal fidelity, semantic consistency, temporal integrity, and schema stability. A reference implementation instantiates the signal contract, the normalizer, and a coverage, latency, and health harness. Illustrative output from that implementation shows how the framework exposes coverage, timeliness, trustworthiness, and failure modes before detections silently degrade. We report no controlled study of production detection improvement, and we state that limit plainly. The contribution is a design method and a measurement model, together with an evaluation harness that future empirical work can use to test them.