3 ms·
Ask HN: Are faster queries on your SIEM a vitamin or a painkiller?
- EricAltmann 4y agoQueries? Which queries? Please don’t let these sneaky vendors fool you with the forensics system boxed as “SIEM”. My splunk Enterprise is not a substance, this is immune system. Carefully trained with ML guided by the group of seasoned cybersecurity practitioners. Correlating and reporting to smart workflow system in the near-real time. Case study example — ransomware like NotPetya/Wannacry being wiped out faster than its ability to replicate and penetrate to extra systems.
- relaunched 4y agoI'm specifically exploring whether or not the ability to run queries quickly would be of value to a hunt-type situation - or more generally speaking, are enterprises losing out because complex queries take too long to run. Selfishly, I'm on the security side, so I think SIEM. But, generally, application-level logging may have the same problem.