Dr Anton Chuvakin Blog (Original)

Security writing since the mid-2000s. New posts are mirrored from Anton on Security on Medium.

Thanks a lot for your most thoughtful comment.

By Anton Chuvakin

To paraphrase, if your 2004 SIEM had normalization problems, it was reasonable to hope that they will be fixed, say, by 2006. Now if the…

Thanks a lot for your most thoughtful comment. I think you are exactly right that it “ works very well in highly valid statistical domains or deterministic environments.” However, my fear is that the HUGE rise of tech search (whether commercial S or open-source E vendors) is proof that the number of such deterministic environments has shrunk OR that the labor to make your environment into on of those is seen as not worth applying.

To paraphrase, if your 2004 SIEM had normalization problems, it was reasonable to hope that they will be fixed, say, by 2006. Now if the same SIEM has normalization problem in 2020 under current conditions, my bet is they are NEVER getting fixed :-(

Originally published at Medium.