The slides in this linked deck made it very clear: https://speakerdeck.com/kennysan/411-a-framework-for-managing-security-alerts https://speakerdeck.com/kennys

The slides in this linked deck made it very clear: https://speakerdeck.com/kennysan/411-a-framework-for-managing-security-alerts https://speakerdeck.com/kennysan/411-a-framework-for-managin... TL;DR - it's for alerting on ELK, claimed to come with a better query language than both SPL and Elastic QueryDSL (for the use case at least), and a decent admin UI for managing the queries.