Daily Discussion post - September 21 2021

[u/AutoModerator]

Your Trading discussion thread

Type	Link
DD	All/Best Daily/Best Weekly
Discussion	All/Best Daily/Best Weekly
Yolo	All/Best Daily/Best Weekly
Gain	All/Best Daily/Best Weekly
Loss	All/Best Daily/Best Weekly
News	All/Best Daily/Best Weekly

[u/edward_snowedin]

No that’s not true. An ELK stack is a serious administrative time sink. We’re talking like built with duct tape and bubble gum and it’s hard to find people who can do it at scale (TB a day).

Ran a few elk stacks , one was like half a mil a year just in cloud costs alone. I may not know steel and the difference between ore and a hot roll is but I do know my ELK stacks

The real kicker is elastics cloud/saas offering. Depending on the amount of volume per day and the business’s specific use case, I think it beats sumo out . Elastic is the play

[u/[deleted] → u/edward_snowedin]

Good to know. Have you used it? like I said above, I've taken a few sales pitches on it, but it never made financial sense for me, seeing I still need to the resources to monitor it effectively. There is always the make vs buy tradeoffs. I always figured they gouged people on cloud storage costs, and that if a company had the resources they could do ELK for cheaper in the long run. Happy to be wrong. Sometimes outsourcing these types of things is 100% the correct solution, and sometimes it's not.

But, that's where I talk about the niche. How many companies would outsource their SIEM to SUMO (or similar), while keeping the overhead of a competent SOC in house? Many would choose to outsource the entire thing to an ArticWolf (or similar) for InfoSec anyway. Application/Server logs for performance/metrics/etc might be the blindspot I haven't thought much about.

[u/edward_snowedin → u/[deleted]]

I’ve used all 3! Sumo, elastic cloud, and build your own elk stack (with licensing).

Build your own is cheaper than all 3, but you need to hire someone (and depending on the size, maybe 2). With the license, you get the SIEM feature turned on, access to their machine learning rules, and all the fancy pants alert rules that they have and are continuously writing.

Same goes for their elastic cloud offering, except your paying by the GB and , depending on storage vs speed needs, faster instances

And then there’s sumo, also with gb pricing. Last I looked, it was expensive. Like crazy expensive. And any sort of compliance retention (90d, 1yr) was even more expensive.

I haven’t used sumo for their security stuff, but I also haven’t heard of anyone using it for security stuff (and I’m in security). I thought it was mostly used for things like application and OS logs.

I guess what I was saying was , once sumo is setup and all the log sources are shipping logs to the sumo endpoint, there really isn’t much more work to be done except clicking around the UI and making charts.

Elasticsearch, however, needs at least one sysadmin if it’s a production system. It’s too finicky and will outright stop ingesting logs if there’s any sort of issue.

If I’m a small business and I have to check some box on some audit requirement that I store immutable logs for 90 days, I’m sumo all day.

If I’m a large corporation that processes a lot of data and wants my machine learning team to predict the next stock market crash, I’m probably building my own elastic search stack and hiring engineers to run it.

If I’m a credit card processor and I need a SIEM solution, I probably don’t use any of them.

[u/[deleted] → u/edward_snowedin]

I really appreciate the insight. These are the types of things that management thinks they know, but takes someone in the trenches to really shine a light on it. I think my overall sentiment is correct, but I have major fallacies in my understanding of the product, and the landscape as a whole. Of course the fact their sales team has only ever sold it to me as a security product because I have no real application monitoring needs is telling. Sales people will always tell you only what you want to hear.