The Challenges of Legacy SIEM Models
summary
Legacy SIEMs charge by data ingested and force conversion into proprietary formats, which makes comprehensive capture slow and expensive and drives most deployments to 30-day retention and aggressive filtering. They skip multimodal sources like video, audio and LLM transcripts so key signals never reach detection. Detections and investigations rely on hand-built rules and SPL detection pipelines, leaving SOCs inundated and able to surface only a small fraction of threats. Multimodal data excluded creates long blind spots.
AI-written summary · about
related talks
33mSecurity Logging Use Cases: Building an Open-Source SIEM
20mSIEM There, Done That: Rising Up in the SecOps Revolution
50mProject DiSIEM
29mReinventing ETL for Detection and Response Teams
29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
01h 05mPractical network defense at scale
28mSupercharging Threat Intelligence with AI
50mInvestigation & Incident Response Challenges for the Hybrid Enterprise