EP228 SIEM In 2025: Still Hard? Reimagining Detection At Cloud Scale And With More Pipelines Cloud Security Podcast By Google podcast

Content provided by Anton Chuvakin. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Anton Chuvakin or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://podcastplayer.com/legal.

Cloud Security Podcast by Google »
EP228 SIEM in 2025: Still Hard? Reimagining Detection at Cloud Scale and with More Pipelines

6d ago 27:09

MP3•Episode home

Guest

Alan Braithwaite, Co-founder and CTO @ RunReveal

Topics:

SIEM is hard, and many vendors have discovered this over the years. You need to get storage, security and integration complexity just right. You also need to be better than incumbents. How would you approach this now?
Decoupled SIEM vs SIEM/EDR/XDR combo. These point in the opposite directions, which side do you think will win?
In a world where data volumes are exploding, especially in cloud environments, you're building a SIEM with ClickHouse as its backend, focusing on both parsed and raw logs. What's the core advantage of this approach, and how does it address the limitations of traditional SIEMs in handling scale?
Cribl, Bindplane and “security pipeline vendors” are all the rage. Won’t it be logical to just include this into a modern SIEM?
You're envisioning a 'Pipeline QL' that compiles to SQL, enabling 'detection in SQL.' This sounds like a significant shift, and perhaps not to the better? (Anton is horrified, for once) How does this approach affect detection engineering?
With Sigma HQ support out-of-the-box, and the ability to convert SPL to Sigma, you're clearly aiming for interoperability. How crucial is this approach in your vision, and how do you see it benefiting the security community?
What is SIEM in 2025 and beyond? What’s the endgame for security telemetry data? Is this truly SIEM 3.0, 4.0 or whatever-oh?

Resources:

229 episodes

#Tech #Anton Chuvakin #Cloudsecurity #Cybersecurity #Security #Cloud IT

EP228 SIEM in 2025: Still Hard? Reimagining Detection at Cloud Scale and with More Pipelines

Cloud Security Podcast by Google

48 subscribers

published 6d ago

MP3•Episode home

Guest

Alan Braithwaite, Co-founder and CTO @ RunReveal

Topics:

SIEM is hard, and many vendors have discovered this over the years. You need to get storage, security and integration complexity just right. You also need to be better than incumbents. How would you approach this now?
Decoupled SIEM vs SIEM/EDR/XDR combo. These point in the opposite directions, which side do you think will win?
In a world where data volumes are exploding, especially in cloud environments, you're building a SIEM with ClickHouse as its backend, focusing on both parsed and raw logs. What's the core advantage of this approach, and how does it address the limitations of traditional SIEMs in handling scale?
Cribl, Bindplane and “security pipeline vendors” are all the rage. Won’t it be logical to just include this into a modern SIEM?
You're envisioning a 'Pipeline QL' that compiles to SQL, enabling 'detection in SQL.' This sounds like a significant shift, and perhaps not to the better? (Anton is horrified, for once) How does this approach affect detection engineering?
With Sigma HQ support out-of-the-box, and the ability to convert SPL to Sigma, you're clearly aiming for interoperability. How crucial is this approach in your vision, and how do you see it benefiting the security community?
What is SIEM in 2025 and beyond? What’s the endgame for security telemetry data? Is this truly SIEM 3.0, 4.0 or whatever-oh?

Resources:

229 episodes

#Tech #Anton Chuvakin #Cloudsecurity #Cybersecurity #Security #Cloud IT

All episodes

Welcome to Player FM!

Player FM is scanning the web for high-quality podcasts for you to enjoy right now. It's the best podcast app and works on Android, iPhone, and the web. Signup to sync subscriptions across devices.

Listen to 500+ topics

Similar to Cloud Security Podcast by Google

Podcasts Worth a Listen

Cloud Security Podcast by Google » EP228 SIEM in 2025: Still Hard? Reimagining Detection at Cloud Scale and with More Pipelines

EP228 SIEM in 2025: Still Hard? Reimagining Detection at Cloud Scale and with More Pipelines

Podcasts Worth a Listen

Welcome to Player FM!

Similar to Cloud Security Podcast by Google

Cloud Security Podcast by Google »
EP228 SIEM in 2025: Still Hard? Reimagining Detection at Cloud Scale and with More Pipelines