Securing the Data Frontier: Real-World Strategies With OpenSearch
summary
Production deployment uses OpenSearch as a real analytics engine ingesting cloud APIs, network and system logs, enriching them with geoip and threat feeds, and storing on hot/warm/cold tiers with 20–40GB shard sizing for performance. Hybrid detection pairs anomaly detection models with rule confirmation, retrained weekly to cut noise and false positives reduced 40%. Operational playbook includes dedicated masters, separate ingest and query nodes, compression-aware ingestion, automated snapshots, and a real case where abnormal read volume plus unusual IP ranges confirmed an API key breach.
AI-written summary · about
chapters (12)
- 0:00OpenSearch security strategies
- 1:04OpenSearch for security analytics
- 2:27Simple security architecture
- 3:34Enriching logs for value
- 4:19High-value security use cases
- 5:42Reducing false positives
- 6:47Three key SOC alerts
- 7:35Cost optimization for OpenSearch
- 8:59Scaling OpenSearch for security
- 9:45Case study: API key breach blocked
- 10:49Key takeaways
- 11:56Q&A
related talks
16mA Thrilling Journey into Data-Driven Security Automation
46mDelivering the next wave of innovation with OpenSearch
29mThreat Modeling for OpenSearch: Identifying and Mitigating Security Risks
55mFirewall Reversed: How Open Source Became Asia's Best Defense
25mThe Art of the Possible with OpenSearch Anomaly Detection and UEBA.
21mKubernetes Under the Magnifying Glass: Observability With OpenSearch
36mThe Forbidden Index: How We Turned OpenSearch Into a Privacy-Preserving Superhero
13mOpenSearch at Atlassian Scale