Operations wants to know whether the service is healthy and, when it is not, why. Security wants to know who did what, from where, and whether it should have been possible. Those are different questions, and they are asked in different tools, but they are asked of the same record.
Where the two diverge
Operations leans on metrics and traces, cares most about the last few hours, and wants aggregates: how many, how slow, trending which way. A log line that is one of ten thousand identical ones is worth counting, not keeping.
Security leans on logs and events, and the individual line is the point. An authentication at an odd hour from an unfamiliar address is interesting precisely because it is singular, and it may not be looked at for months. Retention is longer, fidelity matters more, and aggregation destroys the evidence.
Send both sides the same feed and one of them is paying for data it cannot use.
What security needs that operations does not
Context attached at the time of collection. A raw event says an IP address did something. Enriched, it says which asset that is, who owns it, where the address geolocates, and whether it appears in a threat feed. Doing this in the pipeline means it is done once, consistently, before anything downstream has to guess.
Retention on its own terms. Compliance and audit flows are kept for as long as the regulation says, under their own access controls, separate from operational telemetry that ages out in weeks.
Full fidelity somewhere. The SIEM receives what it needs to detect. An investigation that starts six months later needs what the SIEM did not keep, which is why the archive holds the unabridged version.
Where it lands
Destinations we commonly deliver into, with the ones we work with most named first in each line. The pipeline is built so none of this is a commitment: a destination is a routing decision.
Observability
- Metrics and dashboards: Prometheus, Grafana, InfluxDB, VictoriaMetrics
- Log aggregation: Splunk Enterprise, Elastic Stack, Loki, CloudWatch Logs
- APM and monitoring: Datadog, New Relic, Dynatrace
- Distributed tracing: Jaeger, Zipkin, Tempo, AWS X-Ray
Security
- SIEM: Splunk Enterprise Security, Elastic Security, Microsoft Sentinel, Google Security Operations
- Cloud security posture: AWS Security Hub, Microsoft Defender for Cloud, Google Security Command Center
- SOAR and threat intelligence: response orchestration and IOC enrichment feeds
The pipeline itself runs on a dedicated telemetry pipeline platform, Cribl Stream for example.
Security work here is delivered together with our Cybersecurity area.