Blogs
September 30, 2026 / September 30, 2026 by Matt Eberhart | Leave a Comment
A backup service account logged in from a laptop that had no agent on it, and no alert fired. Identifying the laptop and then the person took five sources, including two live identity stores that are not reachable from the SIEM. Agents wired to each tool separately fail in multiple places. First, they don’t go […]
Read more »
August 3, 2026 / August 3, 2026 by Matt Eberhart | Leave a Comment
This July, in one of my test runs, I watched an AI agent ask a mock firewall, built to answer like a real one, for every event tied to one IP address. The agent sent the timestamp in one format. The firewall expected another. Nothing matched, so the source returned zero rows, with no error […]
April 7, 2026 / April 6, 2026 by Matt Eberhart | Leave a Comment
If Your AI Can’t Prove How It Got There, It Doesn’t Matter How Good It Is. One of our AI agents recently flagged 600+ alerts as an active nation-state intrusion: APT28-attributed malware on multiple hosts, persistence mechanisms everywhere, 16 MITRE ATT&CK techniques mapped across a 30-day campaign. The recommendation was immediate escalation. Confidence: HIGH. It […]
April 2, 2026 / April 1, 2026 by Matt Eberhart | Leave a Comment
AI Agents Don’t Have a Model Problem. They Have a Data Problem. Every major platform at RSAC this year is shipping AI agents for security. Investigation agents, triage agents, hunting agents – and so many promises. Everyone is messaging the same outcomes, let AI do the work. I agree with the vision. I think the […]
November 20, 2025 / December 16, 2025 by Matt Eberhart | Leave a Comment
For years, security teams have faced an uncomfortable truth: the platforms they depend on to detect and respond to threats often create friction in the very workflows they’re meant to streamline. Nowhere is this more apparent than in the relationship between SIEMs like Splunk and platforms like CrowdStrike Falcon, which began as an endpoint detection […]
October 30, 2025 / October 30, 2025 by Matt Eberhart | Leave a Comment
The secret is out. Security data is a mess, and everyone knows it. It’s hard to say what the tipping point was. Maybe it’s the fact that security breaches persist, and the post mortem clean up reveals that the data to detect and prevent was present, but went unused. Maybe it’s the experimenting with AI […]
August 3, 2025 / August 4, 2025 by Matt Eberhart | Leave a Comment
Working side-by-side with some of the most data-forward security teams in the world, I am excited to share that Query has built two new solutions: Query Agents and Query Security Data Pipelines. Both are available now in preview, and both are purpose-built to address the most common, and costly, challenges security teams face when it […]
June 25, 2025 / June 26, 2025 by Matt Eberhart | Leave a Comment
A shift is underway in the security platform and SIEM landscape, and it’s not just driven by vendor hype. As highlighted in the latest Forrester Wave for Security Analytics Platforms report, AI has become a key differentiator, not because of buzzwords, but because of its potential to meaningfully assist security teams. The daily work of […]
June 16, 2025 / June 17, 2025 by Matt Eberhart | Leave a Comment
The best defense against a bad guy with AI is a good guy with AI. That reads like a bumper sticker, but it’s a front-line reality in modern cybersecurity programs. AI has pushed us into a phase shift, one where the barrier to entry is falling fast, and the ceiling for impact is rising even […]
June 11, 2025 / June 10, 2025 by Matt Eberhart | Leave a Comment
Security operations has always been a data problem. The challenge today isn’t a lack of data—it’s that the data you need is spread across too many systems, locked behind too many interfaces, and too hard to use when it matters. Traditional SIEM architectures were designed in a different era, and they haven’t kept up. Most […]
