The Detection at Scale Podcast is dedicated to helping security practitioners and their teams succeed at managing and responding to threats at a modern, cloud scale. Every episode is focused on actionable takeaways to help you get ahead of the curve and prepare for the trends and technologies shaping the future.
Episodes
Tuesday Nov 28, 2023
Tuesday Nov 28, 2023
On this week's episode of the Detection at Scale podcast, Jack talks with Dr. Anton Chuvakin, Senior Security Staff at the Office of the CISO at Google Cloud. They dig deeper into the conversation taking place online around decoupled SIEMs, which both Jack and Anton wrote about. They discuss what a decoupled SIEM is, the evolution of data platforms and security capabilities, if decoupled SIEMs will work broadly with current customer demands, and if having backend data lakes is the best solution for fast, real-time querying.
Topics discussed:
- What is a decoupled SIEM, and why the broader discussion around whether security data lakes will replace SIEMs prompted Anton's Medium post.
- How this conversation is being driven by the fact that we’re coming to the "end of the runway" on previous storage choices.
- The arguments around why decoupling may not work broadly, simply because customers want integrated SIEMs.
- The evolution of data storage platforms and how successful past attempts at integrating security capabilities were.
- Why there's not a straightforward solution to storage — and why it's a challenge that's taking years to solve.
- Why having a data lake on the backend is the best solution to fast querying and real-time detection.
- A discussion around OCSF and the benefits of log normalization.
Resources Mention:
- “Decoupled SIEM: Brilliant or Stupid?” by Anton Chuvakin
- “The Transition from Monolithic SIEMs to Data Lakes for Security Monitoring” by Jack Naglieri
Comments (0)
To leave or reply to comments, please download free Podbean or
No Comments
To leave or reply to comments,
please download free Podbean App.