Siren supercharges Elasticsearch with big data joins, remote data virtualization and true link analysis.
A gamechanger for Cyber, Log analysis and much much more.
The Siren platform extends core ELK capabilities with in-cluster distributed big data joins, true knowledge graph support (with link analysis), data virtualization of JDBC datasources and much more.
Out of the box, critical capabilities for scenarios including:
Siren’s relational and federation technology comes packaged in the Siren Federate™ plugin for Elasticsearch. Siren Federate™ embedded technologies allow for easy vertical and horizontal scaling without impacting the performance of standard Elasticsearch operations.
Standard ELK capabilities are further enhanced by data federation where remote JDBC datasources are virtualized and exposed as if they were local indexes (with joins pushed down to the native sources).
Siren’s front-end supercharges the native Kibana UI with “Investigative Intelligence” advanced capabilities, including:
In Siren, Elasticsearch indexes and remote federated indexes are tied together by a visual relational datamodel. Typically, this can be done in 3 simple steps:
- Connect to your Elasticsearch indexes as usual (or to remote indexes via JDBC)
- Build the data model specifying cross-table primary/foreign relations, or shared identifiers (e.g. IPs, Hashes, UserIDs)
- Done! The data model now powers the UI with relational cross-dashboard drilldowns and record-to-record link analysis.
Siren can be installed on top of Elasticsearch clusters in which free or paid Elastic Subscription packages (formerly X-Pack) have been installed.
Among the features that can typically be added for free are:
Please refer to Elastic.co for details
Siren installed on Elasticsearch cluster which include components from the AWS backed Opendistro for Elasticsearch. Useful features that can be added in this way include:
Siren “Virtual Indexes” look and behave like Elasticsearch indexes for most operations, but translate and forward queries directly to the remote datasources.
Currently supported backends (check the docs for the latest updates):
Reflections are optional, locally materialized Elasticsearch tables which are kept in sync with the content of the remote datasources. Activating datasource reflection lowers the load on the remote datasources for intense analytics, increases the performance and scalability for local users and increases the search and analytics capabilities (e.g. wordclouds and phonetic search and high quality ranking become available on reflected indexes)
Advanced Siren only features include
Get in touch with one of our experts and let us show you how we can leverage your datasets to unearth powerful insights