SIEM Appliance Sizing: Why Hardware Limits Break Detection

Historical Archive Note: This post was originally published on the Gartner Blog Network on September 18, 2007 by Anton Chuvakin.
Original URL: http://blogs.gartner.com/anton-chuvakin/2013/05/22/siem-appliance-sizing-why-hardware-limits-break-detection/ | Archive.org Snapshot

Organizations purchase a 2U or 4U rackmount SIEM appliance rated for 5,000 events per second. The moment an incident occurs and domain controllers start flooding the network with Kerberos failures, the disk I/O queues saturate and the appliance silently drops packets.

Hardware-bound SIEMs create an artificial scarcity: administrators turn off firewall and DNS logs because they cannot afford the storage and compute required to parse them. Scalable security requires decoupled storage and elastic compute.