> Markdown version of [/videos/2118-better-together-leveraging-your-observability-tools-as-a-siem?t=1661](https://www.wearedevelopers.com/videos/2118-better-together-leveraging-your-observability-tools-as-a-siem?t=1661). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Better Together: Leveraging Your Observability Tools as a SIEM

Running separate agents for observability and SIEM drains resources and causes team friction. Discover how a unified telemetry pipeline slashes cloud costs and streamlines threat detection.

- **Speakers:** [Mathias Palmersheim](https://www.wearedevelopers.com/@mathias-palmersheim)
- **Event:** World Congress 2026 Europe - Virtual Stage
- **Published:** July 5, 2026
- **Duration:** 39:06
- **URL:** https://www.wearedevelopers.com/videos/2118-better-together-leveraging-your-observability-tools-as-a-siem

## Summary

Observability and SIEM platforms run on the same fundamental principle: collecting telemetry to interrogate systems and alert on irregularities. Yet, teams traditionally silo these domains, deploying separate, conflicting agents that drain machine resources, duplicate expensive cloud storage constraints, and introduce security risks via expanded attack surfaces. This fractured approach leads to "agent fatigue" and forces responders to jump between disjointed dashboards during stressful, high-stakes incidents. Consequently, operations and security teams develop isolated operational worldviews, often sparking cross-team friction when a proactive penetration test breaks production or a performance monitor inadvertently masks an indicator of compromise.

Merging security and infrastructure telemetry into a single pipeline transforms how organizations approach system reliability and threat detection. Centralizing data collection onto a unified agent—managed primarily by site reliability engineering teams—drastically reduces operational overhead and simplifies enterprise patching cycles. In this shared environment, security platforms can seamlessly alert application owners to outdated software packages, while operations can view security events layered directly over performance metrics. To secure leadership buy-in for this architectural shift, engineers must translate technical benefits into clear business outcomes, highlighting reduced labor hours, lower log transfer costs, and alignment with strict cyber insurance compliance policies.

While unifying SIEM and observability introduces onboarding hurdles—such as migrating specialized threat intelligence rules or bridging data gaps with proprietary SaaS exports—open-source stacks provide a clear blueprint for success. Projects like ShiftMon pair tools like VictoriaMetrics, Telegraf, and Grafana to handle an expansive array of inputs ranging from OpenTelemetry and Syslog to Sysmon and Suricata. This cohesive ecosystem enables practitioners to pinpoint automation process failures in systemd components, analyze long-term egress metrics for potential data exfiltration, and proactively resolve cross-team infrastructure disputes using shared anomaly detection dashboards.

**Keywords:** observability tooling, SIEM consolidation, centralized logging, security telemetry, opentelemetry, agent fatigue, threat surface reduction, incident response alignment, cyber insurance compliance, victoriametrics, shiftmon, telegraf, grafana, sysmon integration, suricata, network flow logs, ansible systemd tracking

## Chapters

1. **Background and origins of the Shiftmon monitoring project** (00:02) — An introduction to observability backgrounds and the creation of an open-source monitoring tool for small setups.
1. **Defining observability beyond basic metrics, logs, and traces** (01:13) — How correlating data from multiple sources enables proactive troubleshooting and accurate system interrogation.
1. **Core functions of security information and event monitoring** (03:54) — How SIEM tools collect telemetry to alert teams about irregularities and vulnerabilities before attacks occur.
1. **Shared stress and negative outcomes of critical system incidents** (05:03) — Why security and infrastructure failures produce identical stress levels, financial losses, and reputational damage.
1. **Unseen consequences of maintaining multiple separated telemetry agents** (06:59) — How installing disjointed collection packages leads to conflicting permissions, high resource usage, and incorrect blame attribution.
1. **Security risks from duplicated effort and increased privileges** (09:49) — Why maintaining parallel storage systems wastes resources and increases the attack surface through privileged commands.
1. **Investigative friction caused by siloed organizational tooling** (11:16) — How context switching across separate interfaces creates blind spots and misaligned priorities between infrastructure and security.
1. **Why differing legacy workflows complicate monitoring tool migrations** (13:49) — How disparate historical development paths and deep-rooted team habits stall efforts to consolidate systems.
1. **Communicating the value of unified observability to leadership** (17:26) — How framing tool consolidation around reduced labor, cloud savings, and cyber insurance secures executive buy-in.
1. **Aligning cross-functional teams with unified management pipelines** (20:51) — How shared dashboard views and pre-configured collectors enable simultaneous incident tracking across security and operations.
1. **Overcoming integration hurdles in consolidated monitoring platforms** (23:25) — Why migrating proprietary security indicators and extracting data from managed cloud services presents significant technical challenges.
1. **Building a unified stack leveraging core open source tools** (27:41) — How combining Telegraf, Grafana, and VictoriaMetrics provides a pre-canned foundation for infrastructure and security logs.
1. **Monitoring automated host compliance via open system instrumentation** (31:52) — How tracking systemd service states surfaces configuration deployment failures before cascading into larger outages.
1. **Correlating granular host system queries with network bandwidth** (34:08) — How combining endpoint process queries with firewall throughput enables rapid diagnosis of anomalies like data exfiltration.
1. **Using machine anomaly detection to resolve cross-team disputes** (36:01) — How referencing shared availability and response time baselines diffuses blame during complex incidents or vulnerability scans.
1. **Debugging application telemetry with unified network flow logs** (37:32) — How comparing trace pipeline behavior against network traffic rules identifies whether misconfigurations stem from ports or collectors.

## Related Moments

- [Introduction to easy mode observability and ShiftMon](https://www.wearedevelopers.com/videos/2114-easy-mode-monitoring-and-logging-with-shiftmon) (from "Easy Mode Monitoring and Logging with Shiftmon")
- [Consolidating cybersecurity tools into a unified platform approach](https://www.wearedevelopers.com/videos/1690-tackling-the-risks-of-ai-with-ai) (from "Tackling the Risks of AI - With AI")
- [Exploring advanced observability stacks and distributed infrastructure challenges](https://www.wearedevelopers.com/videos/544-plan-ci-cd-on-the-enterprise-level) (from "Plan CI/CD on the Enterprise level!")
- [Consolidating observability data within a unified telemetry platform](https://www.wearedevelopers.com/videos/57-all-your-telemetry-data-from-any-source-in-one-place) (from "All your telemetry data from any source in one place")
- [Breaking down silos between developers, security, and ops](https://www.wearedevelopers.com/videos/422-secure-code-superstars-empowering-developers-and-surpassing-security-challenges-together) (from " Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together")
- [Centralizing observability and monitoring tools across isolated edge infrastructure](https://www.wearedevelopers.com/videos/1608-simplifying-edge-app-delivery-one-workflow-thousands-of-devices) (from "Simplifying edge app delivery: one workflow, thousands of devices")

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Now is the time for industrialized software development](https://www.wearedevelopers.com/magazine/601-now-is-the-time-for-industrialized-software-development)
- [MLops – Deploying, Maintaining And Evolving Machine Learning Models in Production](https://www.wearedevelopers.com/magazine/115-mlops-deploying-maintaining-and-evolving-machine-learning-models-in-production)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)

## Related Jobs

- [Senior Security Engineer, Incident Response](https://www.wearedevelopers.com/jobs/ext/1347114-senior-security-engineer-incident-response) at **Twilio**
- [Security Engineer](https://www.wearedevelopers.com/jobs/ext/1574416-security-engineer) at **Twilio**
- [Senior Engineer, Infrastructure Platform](https://www.wearedevelopers.com/jobs/ext/328836-senior-engineer-infrastructure-platform) at **Intercom, Inc.**
- [Senior Security Engineer, Incident Response](https://www.wearedevelopers.com/jobs/ext/1346434-senior-security-engineer-incident-response) at **Twilio**
- [Security Engineer, Incident Response](https://www.wearedevelopers.com/jobs/ext/1249908-security-engineer-incident-response) at **Twilio**
- [Endpoint Security Engineer - OT](https://www.wearedevelopers.com/jobs/ext/1306782-endpoint-security-engineer-ot) at **ZEISS Group**