Siren supercharges Elasticsearch with big data joins, remote data virtualization and true link analysis.
A gamechanger for Cyber, Log analysis and much much more.
The Siren platform extends core ELK capabilities with in-cluster distributed big data joins, true knowledge graph support (with link analysis), data virtualization of JDBC datasources and much more.
Out of the box, critical capabilities for scenarios including:
The Siren relational and federation technology comes packaged in the Siren Federate plugin for Elasticsearch. With Federate patent pending technologies, vertical and horizontal scaling is easily achieved in Siren without impacting the performance of standard Elasticsearch operations.
On top of that, Federate adds “Data Federation” where remote JDBC datasources are virtualized and exposed as if they were local indexes (with joins pushed down to the native sources).
Learn more about Federate and see the benchmarks in our blog post
Siren’s frontend supercharges the native Kibana UI with “Investigative Intelligence” superpowers, including:
What can it do for Cyber? Watch it in action on cyber security logs
In Siren, Elasticsearch indexes and remote federated indexes are tied together by a visual relational datamodel. Typically, this can be done in 3 simple steps:
- Connect to your Elasticsearch indexes as usual (or to remote indexes via JDBC)
- Build the datamodel specifying cross-table primary/foreign relations, or shared identifiers (e.g. IPs, Hashes, UserIDs)
- Done! The datamodel now powers the UI with relational cross-dashboard drilldowns and record-to-record link analysis.
Siren can be installed on top of Elasticsearch clusters in which free or paid Elastic Subscription packages (formerly X-Pack) have been installed.
Among the features that can typically be added for free are:
Please refer to Elastic.co for details
Siren installed on Elasticsearch cluster which include components from the AWS backed Opendistro for Elasticsearch. Useful features that can be added in this way include:
Siren “Virtual Indexes” look and behave like Elasticsearch indexes for most operations, but translate and forward queries directly to the remote datasources.
Currently supported backends (check the docs for the latest updates):
Reflections are optional, locally materialized Elasticsearch tables which are kept in sync with the content of the remote datasources. Activating datasource reflection lowers the load on the remote datasources for intense analytics, increases the performance and scalability for local users and increases the search and analytics capabilities (e.g. wordclouds and phonetic search and high quality ranking become available on reflected indexes)
Get in touch with one of our experts and let us show you how we can leverage your datasets to unearth powerful insights