Observability and SIEM share core functions like telemetry collection, proactive alerting, and data abstraction, and incidents in both domains have similar negative business impacts.
Running separate observability and SIEM tools leads to agent fatigue, duplicated effort in data storage, and tool sprawl during incidents.
Tools remain separate due to their different origins, user resistance to changing familiar workflows, and the technical complexity of migration.
Frame the migration to leadership by focusing on cost savings from reduced storage, improved availability, meeting compliance requirements, and lowering labor costs.
A single platform provides unified management, reduces friction between teams, and creates a single source of truth for faster incident resolution.
Consolidating tools presents challenges like a lack of turnkey integrations, the difficulty of porting domain knowledge, and achieving stakeholder consensus.
ShiftMon is an open-source project that uses VictoriaMetrics to provide pre-canned dashboards and alerting for both infrastructure and security monitoring.
ShiftMon can monitor systemd services to alert on failed Ansible Pull jobs, providing immediate visibility into configuration drift.
By combining firewall metrics, DNS queries, and Sysmon process data, you can quickly investigate incidents and identify suspicious network activity.
Anomaly detection on metrics can help teams objectively determine if their activities, like a security scan, impacted system performance.
Correlating network flow logs from Suricata with trace data helps distinguish between network connectivity problems and application misconfigurations.
Jobs that call for the skills explored in this talk.