As announced in the previous blog post, I have been writing a paper about the security big data lake. A topic that starts coming up with more and more organizations lately. Unfortunately, there is a lot uncertainty around the term so I decided to put some structure to the discussion.
Download the paper here.
A little teaser from the paper: The following table from the paper summarizes the four main building blocks that can be used to put together a SIEM – data lake integration:
Thanks @antonchuvakin for brainstorming and coming up with the diagram.
Scenario 3: “SIEM connector needs to support data formats AND DATA VOLUMES when reading data from lake.”
Comment by Anton Goncharov — March 8, 2015 @ 11:08 pm