Launch HN: Matano (YC W23) – Open-Source Security Lake Platform (SIEM) for AWS

Re:Launch HN: Matano (YC W23) – Open-Source Security Lake Pl... by debarshri on Tuesday January 24, 2023 @12:13PM (#34506607)

I have been exploring this realm of SIEM, XDR, NDR etc. Sure, all proprietary SIEMs are expensive. But what is not clear is how you are going to price it. Security teams have dedicated budget. If you are coming cheaper than them, they you are destroying your TAM because I know customer would not mind paying those license fees. OSS GTM might work but might against your TAM.

[ Parent | on HN ]

Re:Launch HN: Matano (YC W23) – Open-Source Security Lake Pl... by shaeqahmed on Tuesday January 24, 2023 @12:25PM (#34506802)

We think building a more efficient solution using data lakes is a win-win because it unlocks additional use cases for customers and allows them to analyze larger datasets within the same budget.

Solutions that offer a magnitude of order better performance than what is available today are critical for the industry because the amount of data teams are dealing with is growing much faster than their budgets!

[ Parent | on HN ]

Re:Launch HN: Matano (YC W23) – Open-Source Security Lake Pl... by 0x4e53 on Tuesday January 24, 2023 @12:19PM (#34506692)

At least from my time at SpaceX - this is untrue.

SIEM costs were rapidly ballooning, and we were being charged by RAM. RAM?? Of all things!!

After our SIEM costs for ELK ramped up to where Splunk was - we just bought Splunk instead. I imagine there are many security teams out there that would entertain a cheaper alternative that isn't priced by RAM.

[ Parent | on HN ]

Re:Launch HN: Matano (YC W23) – Open-Source Security Lake Pl... by slt2021 on Tuesday January 24, 2023 @12:52PM (#34507236)

the reason for that is near real-time detection of threats requires aggregation of terabytes of data according to rules (continuous GROUP BY on thousands columns on a sliding window) - and these aggregates by design have to be stored in RAM.

Otherwise these detections stop being near-realtime and become offline detection instead, just like any other sql server.

[ Parent | on HN ]

Re:Launch HN: Matano (YC W23) – Open-Source Security Lake Pl... by 0x4e53 on Tuesday January 24, 2023 @04:50PM (#34511001)

To be clear - we were hosting on-premise, and being charged for our own RAM. Servers we had to buy, and then pay for the privilege of using with ELK.

[ Parent | on HN ]