You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/about/siem-optimization.mdx
+5-54Lines changed: 5 additions & 54 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -55,35 +55,9 @@ Key principles include:
55
55
56
56
AI-based approaches introduce multiple risks that VirtualMetric's deterministic framework eliminates. AI models require training on actual log data, creating privacy and compliance concerns as sensitive security information may be learned by the model. AI processing adds significant latency and computational cost, reducing throughput and increasing infrastructure requirements. Most critically, AI decisions cannot be audited or validated, making it impossible to verify that security-relevant data is preserved.
|<ul><li>Unpredictable Results</li><li>May Drop Critical Events</li><li>Privacy Concerns</li><li>Training on Sensitive Data</li><li>Processing Latency</li><li>Increased Costs</li><li>Non-Auditable Decisions</li></ul>|<ul><li>Deterministic Rules</li><li>Guaranteed Field Preservation</li><li>No Data Learning</li><li>High Performance</li><li>Cost-Efficient</li><li>Fully Auditable</li><li>Expert Validated</li></ul>|
87
61
88
62
**DataStream**'s expert-driven approach provides predictable, consistent results that security teams can trust. Every optimization decision is based on analysis of real-world security operations, validated by experts, and documented for audit purposes. Organizations can confidently deploy aggressive optimization knowing that detection capabilities remain intact.
89
63
@@ -104,7 +78,7 @@ Advantages over AI-based optimization include:
104
78
This approach means administrators configure optimization rules once per vendor, not once per vendor per SIEM platform. A single Fortinet optimization pack automatically reduces data volume for Sentinel, Splunk, Elasticsearch, and all other configured destinations. Changes to vendor-specific filtering rules immediately apply across the entire multi-platform deployment.
0 commit comments