3 posts tagged with "streaming"

I'd like to spend this post inside the Motion Engine. The previous post showed a pipeline from the outside with ingesting syslog data, filtering 'deny' events, a 30-second aggregation rollup to Splunk, and sending raw to S3, which is enough to get started but hides the parts I'd like to mention here. What happens when the downstream systems (e.g. SIEM) slows down? What survives a restart? Why does a task that counts things behave differently from one that parses things?

Those answers live in two objects: streams and tasks. Both carry more configuration surface than they first appear to, and that surface is deliberate. The knobs below are what let the same binary sit at a branch office dropping what it must, or in a datacenter with a durable log and a replay window.

Padas Motion is our security streaming product. It shapes telemetry while the data is still moving (filter, parse, aggregate, detect, route) and hands cleaner, higher-value events to the tools you already run.

Motion is also the first chapter of a longer arc, it shapes the data while it moves, then Chronos allows organizations to own the context built from it. Motion is the part you can run today.

This post is the introduction; we focus on what's in v0.1.0, how a pipeline is put together, and what a PDL task actually looks like.

In today's rapidly evolving cybersecurity landscape, security teams face unprecedented challenges. They're dealing with exponential growth of security data, alert fatigue from increasingly sophisticated adversaries, and a critical shortage of skilled analysts.

The goal for security operations centers (SOC) has remained largely the same: lower MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond), reduce false positives, and scale as needed. However, achieving these goals has become exponentially more difficult.

In this context, security telemetry pipelines aren't just enhancements—they're becoming a necessity. In a world where terabytes of data flood your SIEM daily, real-time context (e.g., reasoning and detection logic with security ontologies) and intelligent filtering can no longer be optional.