The Art of the Possible with OpenSearch Anomaly Detection and UEBA.
summary
Graylog uses OpenSearch anomaly detection as the engine for UEBA, auto-creating and configuring detectors that run in the OpenSearch cluster while Graylog pulls results into its event system for dashboards, alerts and SOAR actions. Architecture writes logs to OpenSearch (MongoDB holds state), scales horizontally, and supports enrichment (WHOIS) in pipelines. Demo data shows 33 anomalies discovered, 1 high‑grade anomaly with score 0.92, 2 detectors running and 12 users flagged.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:27Greylog history
- 3:00Use cases
- 6:27Switching to OpenSearch
- 9:11Architecture overview
- 13:21What is UEBA
- 18:42Anomaly detection
- 21:36Demo and conclusion
related talks
13mSecuring the Data Frontier: Real-World Strategies With OpenSearch
31mAnomaly Detection on OpenStack Logs using M.L.
40mAgentic Relevance Tuning With OpenSearch: Faster, Easier, and Higher Quality Search at Scale
16mA Thrilling Journey into Data-Driven Security Automation
38mOpen-source Dashboarding Tools. Which One Suits You?
20mGenAIOps - OpenSearch for AI & GenAI Platform Observability
40mBoost your workloads with OpenSearch innovations
01h 00mElasticsearch: you know, for more than search