The center of gravity in the SOC has moved
Investigation and hunting are moving to where the data sits. That move does not settle the data question: what exists to be reached, and in what condition.
Most pipelines cannot answer it. They are transport layers: rules written once, a little filtering, hand-tuning when something breaks. That held up when there was one destination and requirements changed once a year.
It does not hold up now. Agents draw on the SIEM, data lakes, and cloud storage at once, and what each swarm needs from the data changes faster than anyone can hand-tune.
Agents need more than raw alerts: they reason against users, assets, policies, and history. Federated search reaches what exists. Which sources were connected, whether they are complete, and what was collected in the first place is decided upstream.
So the team has to run a pipeline that understands the data and makes decisions about it, and know the systems their agents query are complete before an investigation finds the gap.
What's inside
- 01The center of gravity in the SOC has movedInvestigation and hunting are moving to where the data sits, and most pipelines cannot answer what exists to be reached
- 02What changes with Realm upstreamThe status quo versus Realm reading each source field by field and recommending what to keep, cut, normalize, enrich, and route
- 03At a glanceIndependent collection, in-stream enrichment, Detection Integrity, complete retention, data composition