# What are Pipelines?

import WhatIsAPipeline from "../../partials/pipeline/what-is-a-pipeline.mdx";
import PipelineStructure from "../../partials/pipeline/structure.mdx";
import PipelineRules from "../../partials/pipeline/rules.mdx";
import PipelineStatuses from "../../partials/pipeline/statuses.mdx";

<WhatIsAPipeline />

This guide is a conceptual tour of what a pipeline is made of and how data moves through it. Each component has its own reference documentation, linked inline.

<PipelineStructure />

## The components of a pipeline

Every node in a pipeline is one of a few component types, each with a distinct job:

- **Inputs** are the entry point — each connects to a specific upstream source and pulls its data into the pipeline, handling authentication and initial formatting. See [Inputs](/docs/inputs).
- **Transforms** reshape each record as it passes through, one record at a time — cleaning, normalizing, and restructuring it. See [Transforms](/docs/transforms).
- **Enrichments** add context to a record mid-flight: they look up a value (a *join key*) and write the result back onto the record. See [Enrichments](/docs/enrichments).
- **Conditionals and routing** decide which records travel down which edge, based on their content. See [Data Routing](/docs/routing) and [Conditionals](/docs/conditionals).
- **Outputs** are the exit point — each delivers processed records to a downstream destination such as a SIEM, data lake, or object store. See [Outputs](/docs/outputs).

For enrichment, normalization, and routing in more depth, see [Enrichment, Normalization, and Routing](/docs/guides/enrichment-normalization-routing).

## How data flows through a pipeline

Data always flows forward through the graph. A node has a single incoming edge but can **fan out** to multiple downstream nodes, which gives a pipeline its tree shape and makes data lineage easy to trace.

Every outgoing edge is evaluated for every record, independently of the others — so a single record can match multiple edges and be delivered to several destinations at once, for example routing high-severity findings to a SIEM while archiving everything to cloud storage.

<PipelineRules />

## Node and pipeline states

<PipelineStatuses />

The full reference, including sync types, is on the [Pipeline Status Indicators](/docs/pipeline_status_indicators) page.

## Related

- [Pipelines](/docs/pipelines)
- [Inputs](/docs/inputs) · [Transforms](/docs/transforms) · [Enrichments](/docs/enrichments) · [Outputs](/docs/outputs)
- [Data Routing](/docs/routing) · [Conditionals](/docs/conditionals)
- [Enrichment, Normalization, and Routing](/docs/guides/enrichment-normalization-routing)
- [Monitoring and Alerting](/docs/guides/monitoring-and-alerting)
- [Pipeline Status Indicators](/docs/pipeline_status_indicators)