Summary
This document is a technical report detailing the Red Canary Security Data Lake, which addresses the challenges organizations face in executing their security data strategies. It outlines the trade-offs between optimizing for threat detection and managing storage costs. The report explains how the Security Data Lake provides cost-efficient storage solutions, allowing organizations to send raw data for detection and response purposes. Key features include log retention, search capabilities, and managed detection and response (MDR) services. The document also describes how organizations can reduce SIEM costs by storing high-volume, low-fidelity data sources at a fraction of the cost. Additionally, it discusses compliance with retention requirements and the ability to investigate stored data, enhancing overall security posture. The report specifies planned availability dates for certain features, emphasizing the operational aspects of leveraging stored data for investigations.
