Tomer Weingarten
Management
Yes. Look, our data lake is built on being totally open, and that is the key to all of it. We don’t, lean on any one specific vendor. And actually, in many cases, and even with deals that we’ve done last quarter, we ingest data even when we’re not the endpoint provider. So to us, it’s really about being fully open and having the ability to ingest data directly from a network provider, from the email provider, from an authentication provider, much like Splunk. Splunk did not own any one of these assets. They were leaning on integration into their platform. We do it with OCSF. It’s a complete open format. We’re one of the founding members in that alliance. And that allows us complete flexibility in ingesting data from any ecosystem product that you have in your enterprise. With that said, typically, within a classic SIEM environment, 60% to 70% of the data that you find in the SIEM is actually generated from EDR products. I’ve been saying that for years, which was really one of the reasons why we thought it makes a whole lot of sense to actually start embedding the other components in enterprise into that same data lake, infusing it with the endpoint data. Moreover, we’re not talking just about threat indicators. We’re talking about fully fledged log analytics. What we ingest into Data Lake is all pieces of data, not just curated threat indicators, but any log line, any event can be ingested. I think that’s one of the keys in an era where keeping logs becomes this requirement that is becoming more and more important, keeping logs for longer. If you need to retain your logs for a year worth of time, doing it with any one of these incumbent platforms is going to be a highly cost prohibitive practice. That’s why when we look at the potential for security data lake, it’s not XDR, it’s not a SIEM, it’s built to be a vast petabyte scale log ingestion mechanism to put all logs. We don’t discriminate logs, we want all of them in and that’s what we believe can also allow for better AI utilization. Once you’re able to feed all that data and expose it to AI algorithms, you’ll be able to get to much more accurate results versus just putting threat events into these different data stores.