You can watch the full video here:
youtu.be/HxCVEowQZLE
10.06.2025 15:23
👍 0
🔁 0
💬 0
📌 0
You can watch the full video here:
youtu.be/HxCVEowQZLE
What is OCSF?
There's a lot of grumbling about OCSF.
Here's why it's worthwhile:
www.youtube.com/watch?v=HxCV...
What if your SIEM only saw the logs that mattered?
youtube.com/shorts/EeOwf...
You can see your entire data ecosystem like this:
youtube.com/shorts/ELa0W...
The old way...
Too many security teams blame the rule.
They tweak logic, write exceptions, tune thresholds, and still drown in false positives.
But the problem isn’t the rule. It’s the data feeding it.
Bad data in=bad alerts out.
Filter, shape, and enrich telemetry BEFORE it hits your SIEM.
👉 www.datable.io 👈
Detection engineers may have the hardest job in tech.
Their role is absolutely critical, they're ignored until something is wrong (rarely praised), and they're consistently pulled away from their core competency to solve other problems.
Am I wrong?
My 2 cents.
Do you agree?
The plan was simple:
Build Cribl for Datadog.
Big Problem. Clear Pain. Let's go.
—But no one adopted it.
Now I'm looking to SecOps folks for their opinion.
www.linkedin.com/pulse/one-ca...
Working on a post for Hacker News (the y combinator board).
Wish me luck.
Noisy, redundant security data?
Shape it, enrich it, and route it exactly where it’s needed IN THE PIPELINE—before it drains your SIEM.
Try Datable and make your logs work smarter, not pricier.
Should CISOs report to the CEO?
Usually it's CISO>CIO/CTO>CEO.
But I'm seeing CISOs role bloom into a copilot role more often. (At least in SF.)
Writing a whole article on this tonight.
Shape data in the pipeline, before it gets astronomically slow and expensive to query.
How did data monitoring get so expensive?
Why are observability bills through the roof?
Watch here:
youtu.be/C1ubXpNo7AU
Secret sauce in this guide:
✅ Hidden Observability Costs
✅ Vendor Negotiation
✅ Data Optimization Strategies
Download it here: datable.io
SREs need secure pipelines. Pipelines others can't touch.
But PMs and BI teams need access to the right data, too.
With Datable, everyone gets a pipeline they control—secure, flexible, and theirs alone.
REMINDER:
I have a full video explaining how to reduce #observability costs.
Free gold for any engineer who wants to have a massive impact on their company's bottom line.
www.youtube.com/watch?v=ZyN-...
Here's how it works:
This also makes it really easy for us to send the data to third party vendors. If we need to send something out in the Splunk or New Relic format, it’s not a problem.
We take it from that OTel format, transform it into their API, and send it on its way.
By normalizing, you ensure consistency. No more dealing with "user_ID" in one place and "userID" in another.
Since data comes from various sources, Datable supports a wide range of formats and protocols: Syslog, Json, Fluent, and open source protocols like the New Relic and Datadog wire protocols.
We treat everything as an event at my company.
Log data, trace data, metrics—everything.
And we normalize those events into the OpenTelemetry standard, creating a single, unified playing field for all of our data.
Here's why:
And who can blame them? The risk involved.
Developers, business teams—they get completely shut out.
It's a horrible feedback loop where the people who need the data most, can't touch it.
"Hey, I'm taking Apache data and converting it to structured JSON."
Great. No problem.
But the second you introduce multiple inputs, different teams, complex transformations—the whole system falls apart. One mod can break everything.
So what do SREs do?
They lock down the configuration.
OTel isn’t enough anymore. (THREAD)
Nobody tells you what happens when you use these tools in the real world.
Files get EXTREMELY difficult to manage.
They're great at collecting and sending data, but the more responsibility you put into them, the more complex and slower they become...
We normalize events into the OTel standard to create a unified playing field for all our data, regardless of origin.
Datable supports: Syslog, Json, Fluent—AND open source vendor protocols, like NR & DD.
By normalizing all our data, we ensure consistency even as data comes from various sources.
Had a video to share today but it's 62 seconds long and there's a hard 60-second limit here.
To see it on YouTube, go here:
youtube.com/shorts/Mz0S2...
