Which Enrichments Belong in Pipelines vs SIEMs

Guest:

• Balazs Scheidler, CEO at Axoflow, original founder of syslog-ng

Topics:

• Are we really coming to "access to security data" and away from "centralizing the data"?
• How to detect without the same storage for all logs?
• Is data pipeline a part of SIEM or is it standalone? Will this just collapse into SIEM soon?
• Tell us about the issues with log pipelines in the past?
• What about enrichment? Why do it in a pipeline, and not in a SIEM?
• We are unable to share enough practices between security teams. How are we fixing it? Is pipelines part of the answer?
• Do you have a piece of advice for people who want to do more than save on their SIEM costs?

Resources:

• EP197 SIEM (Decoupled or Not), and Security Data Lakes: A Google SecOps Perspective
• EP190 Unraveling the Security Data Fabric: Need, Benefits, and Futures
• EP228 SIEM in 2025: Still Hard? Reimagining Detection at Cloud Scale and with More Pipelines
• Axoflow podcast and Anton on it
• "Decoupled SIEM: Where I Think We Are Now?" blog
• "Decoupled SIEM: Brilliant or Stupid?" blog
• "Output-driven SIEM — 13 years later" blog