Blogs
April 10, 2025 / April 10, 2025 by Jonathan Rau | Leave a Comment
Introduction Regarding your security program: speed, precision, and context aren’t just luxuries, they’re table stakes. As the volume of security-relevant data explodes across cloud platforms, SaaS tools, and hybrid infrastructure, traditional approaches to detection engineering capabilities are negatively impacted. If your current detection strategy still relies solely on your SIEM’s native capabilities or is tied […]
Read more »
April 2, 2025 / April 2, 2025 by Jonathan Rau | Leave a Comment
Introduction Security leaders and SecOps organizations face a paradox: the more data we collect to defend our organizations, the harder it becomes to analyze that data efficiently. For CISOs, CIOs, Heads of Detection Engineering, and SOC leaders, the challenge is no longer about collecting data, it’s about using it and using it effectively. Federated Search […]
April 1, 2025 / April 1, 2025 by Jonathan Rau | Leave a Comment
Introduction As we spoke about in previous blog posts, and what is very apparent to everyone anyway, is that there is so much damn data. The jury is still out on what security data strategy will rule the day, be it centralization, decentralization, or federation but teams still need to access it ASAP. To get […]
March 24, 2025 / March 26, 2025 by Jonathan Rau | Leave a Comment
Introduction When you think of the leaders in the Endpoint Detection & Response (EDR) space, even if you do not personally use them, you cannot deny CrowdStrike’s leadership and innovation. However, to consider CrowdStrike as simply an EDR company is a mistake, as over the years they have expanded into everything from Vulnerability Management with […]
March 20, 2025 / March 20, 2025 by Jonathan Rau | Leave a Comment
Introduction Security teams generate and consume vast amounts of data from firewalls, endpoint detection and response (EDR) systems, intrusion detection systems (IDS), and other security telemetry sources. Traditional SIEMs and log management tools often struggle with scalability, cost, and performance when handling these high-velocity logs. Open lakehouse architectures offer a flexible, cost-efficient alternative, and Delta […]
February 18, 2025 / February 18, 2025 by Jonathan Rau | Leave a Comment
Introduction The Microsoft Security ecosystem is large, which is certainly one of the understatements of all time, but when you combine the actual security-related SKUs and security-relevant data it is VERY large. Everything from Microsoft Entra ID (formerly known as Azure Active Directory) to the mobile device management platform Microsoft Intune, as well as the […]
February 6, 2025 by Jonathan Rau | Leave a Comment
Introduction As of January 31st 2025, the latest version of the Open Cybersecurity Schema Framework (OCSF)–version 1.4.0–has been released! The 1.4.0 release represents a very large increment to the schema, and was nearly six months in the making. The schema expanded greatly in this release to include a brand new category and profile, several new […]
January 28, 2025 / February 6, 2025 by Jonathan Rau | Leave a Comment
Introduction Query SecDataOps operators are standing by with another entry in our Open Cybersecurity Schema Framework (OCSF) mapping series. In this blog, we’ll focus on mapping Amazon Application Load Balancer (ALB) access logs to the OCSF format. OCSF is a standardized schema designed to help organizations normalize and correlate data from different sources, making it […]
November 6, 2024 / October 1, 2025 by Jonathan Rau | Leave a Comment
Map stuff real good, by the Query SecDataOps Goons Introduction The Open Cybersecurity Schema Framework (OCSF) is an open-source and collaborative effort across the industry to define a vendor- and platform-agnostic schema for security and IT observability data. It has been contributed to by Query, Amazon Web Services (AWS), Splunk, Cisco, Crowdstrike, and several dozen […]
September 25, 2024 / September 26, 2024 by Jonathan Rau | Leave a Comment
Introduction Amazon Web Services (AWS) Transit Gateway (TGW) is an AWS that acts as a highly scalable cloud network router. Released in November 2018, TGW allows you to connect many different Amazon Virtual Private Clouds (VPCs), AWS Direct Connect (DX) Gateways, and AWS Site-to-Site VPNs together in a centralized hub. This greatly simplifies hybrid and […]
